Encrypting device, encrypting method, and recording medium

ABSTRACT

From the least significant bit of the current secret key, k bits are retrieved, obtaining a binary window sequence. A binary bit string of concatenation of the random number to the more significant bits of the window sequence is obtained if the most significant bit of the window sequence is 0, subtracting a bit string from the current secret key to obtain a new secret key, or the bit string of a complement of the base number for the window sequence in binary system is calculated if the most significant bit of the window sequence is 1, obtaining a bit string by adding a minus sign to a bit string obtained by concatenating the random number to the more significant bits of the bit string, subtracting the bit string from the current secret key to obtain a new secret key.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a divisional application of U.S. application Ser.No. 13/927,641, filed Jun. 26, 2013, which is a continuation applicationof International PCT Application NO. PCT/JP2010/073635 filed on Dec. 27,2010.

FIELD

The embodiments described below are related to an elliptical curvecryptography device, an encrypting method, and a program for the deviceand the method.

BACKGROUND

Recently, information security technology has become more and moreimportant. In addition, as one of the basic techniques of informationsecurity, public-key cryptography has been more widely studied.

There are some types of public-key cryptography, and a Rivest, Shamir,Adleman (RSA) algorithm which use modular exponentiation calculation,elliptical curve cryptography (ECC) using a scalar multiplication of apoint on an elliptical curve, etc. are well known.

In using the public-key cryptography, it is important to keep a privatekey secret to maintain the security. However, there have been someaggressive methods to break a private key. Therefore, it is necessaryfor a tamper-proof equipment unit for performing a process usingpublic-key cryptography to be implemented with a countermeasure againstat least known aggressive methods.

For example, an aggressive method called a power analysis (PA) attack isknown as a type of side channel attack. Furthermore, the PA includes twotypes of analyses, that is, a simple power analysis (SPA) and adifferential power analysis (DPA).

Therefore, when an equipment unit performs a process using thepublic-key cryptography, it is requested to be secure against the SPAattack and the DPA attack. For example, one of the countermeasuresagainst the SPA attack is a method called a window method, and one ofthe countermeasures against the DPA attack a method for randomizingdata. Furthermore, a cryptography device for realizing a modularexponentiation and scalar multiplication of a point of efficienttamper-proof and for an encrypting method for performing a modularexponentiation, a cryptography processor for making difficult theestimation of a private key using a PA attack have been proposed.

DOCUMENT OF PRIOR ART Patent Document

-   [Patent Document 1] Japanese Laid-open Patent Publication No.    2000-132096-   [Patent Document 2] Japanese Laid-open Patent Publication No.    2003-233307-   [Patent Document 3] International Publication Pamphlet No.    WO2009/122461-   [Non-patent Document 1] [IEEE P1363] IEEE P1363/D13 (Draft Version    13, Nov. 12, 1999) main document, Standard Specifications for Public    Key Cryptography, http://grouper, ieee.org/groups/1363/draft.html-   [Non-patent Document 2] [Kocher99] P. Kocher, J. Jaffe and B. Jun    “Differential Power Analysis”, Crypto '99, LNCS 1666, pp. 388-397,    Springer-Verlag, 1999.

When a window method (or a variation of the method) in which the windowsize is k bits is adopted for a device that performs a scalarmultiplication of a point on a elliptical curve as a countermeasure toSPA attack, the memory stores data indicating the point on theelliptical curve corresponding to each index of k bits. Therefore, theamount of used memory is an exponential order of the window size k, andthe larger the window side k is, the more the amount of used memoryincreases.

On the other hand, the use of the cryptography technology has recentlybecomes widespread in various devices such as embedded device inaddition to a general-purpose computer such as a server computer, apersonal computer, etc. It is requested to implement a device whichperforms a scalar multiplication with a countermeasure against both theSPA attack and the DPA attack regardless of the type of device.

However, the amount of the memory of a embedded device is much smallerthan the amount of the memory of a general-purpose computer. With adevice of a small amount of memory, it is preferable that a process isperformed with the smallest possible amount of used memory.

SUMMARY

According to an aspect of the present invention, an encrypting deviceincludes: a random number generation unit which generates a binaryrandom number s of b bits; a window value determination unit whichretrieves k bits from the least significant bit of the current secretkey d, wherein the (b+m×k) bits of the binary secret key d in ellipticalcurve cryptography are used as an initial value using b, m, k, and i asnatural numbers including 0, and performs a calculation for a binarywindow sequence w(i); a correction value calculation unit which obtainsa binary bit string x=(s∥w(i)) by concatenating the random number s tothe more significant bits of the window sequence w(i) if the mostsignificant bit of the window sequence w(i) is 0, subtracts a bit stringx from the current secret key d and defines the result as a bit stringof a new secret key d, calculates the bit string of a complement of thebase number for the window sequence w(i) in binary system if the mostsignificant bit of the window sequence w(i) is 1, obtains a bit string−x=−(s∥v) by adding a minus sign to a bit string obtained byconcatenating the random number s to the more significant bits of thebit string v, subtracts the bit string −x from the current secret key d,and defines the result as a bit string of a new secret key d; a controlunit which, while changing i from m−1 to 0, repeatedly performs theprocesses of the window value determination unit and the correctionvalue calculation unit until i reaches 0 or immediately before the valueof the bit string of the secret key d becomes a negative value; a windowvalue storage unit which stores each of the window sequence w(i)obtained after completing the operation of the control unit; acorrection value storage unit which stores as a correction value d′ thebit string of a secret key d obtained after completing the operation ofthe control unit; a random number storage unit which stores the randomnumber s generated by the random number storage unit; and an encryptingoperation execution unit which performs an encrypting operation usingthe secret key d, the random number s stored in the random numberstorage unit, each window sequence stored in the window value storageunit, and the correction value d′ stored in the correction value storageunit.

According to an aspect of the present invention, adopting the windowmethod maintains the security against the SPA, randomizing table datamaintains the security against the DPA, thereby realizing the reductionof the table size and providing an encrypting operation device whichalso realizes simple carry control.

The object and advantages of the invention will be realized and attainedby means of the elements and combinations particularly pointed out inthe claims.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and arenot restrictive of the invention, as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an explanatory view of the outline of a power analysis;

FIG. 2 is an explanatory view of a simple power analysis (SPA) and adifferential power analysis (DPA);

FIG. 3 illustrates the algorithm of a scalar multiplication process of apoint using the binary method;

FIG. 4 is an explanatory view of a scalar multiplication process of apoint by the binary method;

FIG. 5 illustrates an example of a power waveform when the SPA is usedfor the binary method in FIG. 3;

FIG. 6 is an explanatory view of an operation of judging a private keybit by a differential waveform in the DPA;

FIG. 7 is an explanatory view of the DPA countermeasure by randomizingdata;

FIG. 8 illustrates the algorithm of a scalar multiplication process of apoint using the window method;

FIGS. 9A and 9B provide an explanatory view of a scalar multiplicationprocess of a point using the window method;

FIG. 10 is an example of a power waveform using the SPA for the windowmethod;

FIGS. 11A and 11B provide an explanatory view of the difference betweena common window method (second comparison example) and a randomizedwindow method (third comparison example);

FIG. 12 illustrates the algorithm of a scalar multiplication process ofa point using the randomized window method;

FIGS. 13A and 13B provide an explanatory view of the comparison betweena common window method (second comparison example) and a signed windowmethod (fourth comparison example);

FIG. 14 is an explanatory view of the reason for not being able tocombine the randomized window method (third comparison example) and thesigned window method (fourth comparison example);

FIG. 15 is a chart indicating the comparison among effects of variousmethods;

FIG. 16 is the first hardware configuration example of an encryptingdevice according to the first through third embodiments;

FIG. 17 is the second hardware configuration example of an encryptingdevice according to the first through third embodiments;

FIG. 18 is an explanatory view of the configuration of the functions ofthe window value determination unit of the encrypting device accordingto the first through third embodiments;

FIG. 19 is an explanatory view of the configuration of the functions ofthe scalar multiplication calculation unit of the encrypting deviceaccording to the first through third embodiments;

FIGS. 20A and 20B are a flowchart of the window value determinationalgorithm according to the first embodiment;

FIG. 21 is an explanatory view of the operation of the window valuedetermination algorithm according to the first embodiment;

FIGS. 22A and 22B are a flowchart of the scalar multiplication algorithmof a point according to the first embodiment;

FIGS. 23A and 23B are a flowchart of the window value determinationalgorithm according to the second embodiment;

FIG. 24 is an explanatory view of the operation of the window valuedetermination algorithm according to the second embodiment;

FIGS. 25A and 25B are a flowchart of the scalar multiplication algorithmof a point according to the first embodiment;

FIGS. 26A and 26B are a flowchart of the window value determinationalgorithm according to the third embodiment;

FIG. 27 is an explanatory view of the operation of the window valuedetermination algorithm according to the third embodiment;

FIGS. 28A and 28B are a flowchart of the modular exponentiationalgorithm according to the third embodiment; and

FIG. 29 is a chart indicating the comparison of the effects among thefirst through third embodiments and various methods.

DESCRIPTION OF EMBODIMENTS

The embodiments of the present invention are described below in detailwith reference to the attached drawings. The order of the explanation isdescribed below.

The encrypting device according to the first through third embodimentsdescribed later generates the data for performing the scalarmultiplication on the point on an elliptical curve (concretely a windowsequence w(i), the random number string s[i], and the correction valued′), and performs a scalar multiplication using the generated data. Tohelp understand the first through third embodiments, the operation on anelliptical curve is first explained below. In addition, to also helpunderstand the first through third embodiments, the first through fourthcomparison examples are also explained below.

Then, the common points between the opinion obtained by the applicant ofthe present application from the survey of the comparison example andthe processing method according to the first through third embodimentsdeveloped by the applicant based on the opinion is described. Inaddition, the first through third embodiments are sequentiallyexplained, and other embodiments are finally described.

<Outline of Operations of ECC>

The operations on an elliptical curve are described first. The mainelliptical curves used in the ECC are the elliptical curve expressed bythe equation (1.1) defined on the prime field (p), and the ellipticalcurve expressed by the equation (1.2) defined on the extension field GF(2^(m)) (The GF is short for Galois field, and p indicates a primenumber).y ² =x ³ +ax+b(mod p)  (1.1)

where p indicates a prime number;

-   -   a and b indicate elliptical curve parameters (0≦a,b<p)        a,b,x,yεGF(p)        y ² +xy=x ³ +ax ² +b(mod f(x))  (1.2)

where f (x) indicates a polynomial of GF (2^(m)),

-   -   a and b indicate elliptical curve parameters (0≦a,b<p)        a,b,x,yεGF (2^(m))

As described above, a and b are called elliptical curve parameters forunique determination of an elliptical curve.

The point A on the elliptical curve expressed by the equation (1.1) isexpressed as A=(x,y) by the pair of x and y which satisfy the equation(1.1). Similarly, the point A on the elliptical curve expressed by theequation (1.2) is expressed as A=(x,y) by the pair of x and y whichsatisfy the equation (1.2).

Furthermore, an infinite point and a base point are defined as specificpoints on an elliptical curve. The infinite point is hereafter referredto as “O”, and the base point is hereafter referred to as “G”. The basepoint G is a point on an elliptical curve, used in common by users ofelliptical curve cryptography, and is used various functions using theelliptical curve cryptography in, for example, generating a pair ofpublic key and private key.

The discussion below in the present specification holds true with theelliptical curve expressed by the equation (1.1) and the ellipticalcurve expressed by the equation (1.2). Therefore, in the descriptionsbelow, the discrimination between the equation (1.1) and the equation(1.2) is not performed, but an “elliptical curve”, a “point A”, a “point(x,y)”, an “x coordinate”, a “y coordinate”, “elliptical curveparameters a and b”, etc. may be expressed.

It is known that when an operation (hereafter referred to as an“addition”, and expressed as “+”) is defined on the points on anelliptical curve, a set of points on the elliptical curve form acommutative group. The infinite point O corresponds to a zero element(that is, a unit element in an addition). Furthermore, the equation(1.3) holds true for an arbitrary point A (the point A may be theinfinite point O) on the elliptical curve.A+O=O+A=A

The inverse element of the point A is expressed as −A in the descriptionbelow. The X and Y coordinates of the point −A may be calculated by anaddition or a subtraction on the field GF (p) or GF (2^(m)). To beconcrete, the point −A as an inverse element of the point A=(x,y) isexpressed by the equation (1.4) when the elliptical curve is defined bythe equation (1.1), and is expressed by the equation (1.5) when theelliptical curve is defined by the equation (1.2).−A=(x,−y)  (1.4)−A=(x,x+y)  (1.5)

As understood from the equations (1.4) and (1.5), the computationalcomplexity is low in obtaining the point −A from the point A. In thesigned window method and the first through third embodiments describedlater, the amount of the used memory may be reduced by using thecomputational simplicity of an inverse element. The computationalsimplicity of an inverse element is contrasted with the computationaldifficulty in a division of a prime field used in RSA cryptography.

The x and y coordinates of a point A₃ expressed as A₃=A₁+A₂ with respectto points A₁ and A₂ may be calculated by an addition, a subtraction, amultiplication and a division on the field GF (p) or GF (2^(m)) usingthe x and y coordinates of the points A₁ and A₂. When A₂=A₁, A₃=A₁+A₁may also be expressed as 2A₁, and the operation for obtaining the pointA₃=2A₁ from the point A₁ is referred to as a doubling. The doubling isalso realized by an addition, a subtraction, a multiplication and adivision on the field GF (p) or GF (2^(m)).

Furthermore, the subtraction is defined as an addition of an inverseelement as expressed by the equation (1.6).A ₁ −A ₂ =A ₁+(−A ₂)  (1.6)

In addition, for the point A on the elliptical curve, the operationreferred to as a scalar multiplication is defined using the integer xcalled a scalar value. The scalar multiplication of a point is tocalculate the point V on the elliptical curve which satisfies thefollowing equation (1.7) from the integer x referred to as a scalarvalue.V=xA  (1.7)

In the ECC, a process is performed using X as secret information. Forexample, when an ECDH key is exchanged, a safe key agreement is realizedby calculating the value of the point V on the elliptical curve whichsatisfies the following equation (1.8) where A indicates the point onthe elliptical curve as a public key of a communication partner, and dindicates a private key.V=dA  (1.8)The third party who is not informed of the value of the private key d isnot able to calculate the value of a correct agreed key.

In the equation (1.8), d indicates a private key which is not to berevealed to an unauthorized third party such as an attacker etc. Thatis, in the ECC, protecting the value of d is an important tamper-prooffunction.

Although the values other than d are known in the equation (1.8), it isa mathematically difficult discrete logarithm problem to obtain d withina realistic processing time because the computational complexity is toohigh in calculating the value of d. To be more concrete, when theelliptical curve parameter is 160 bits or more, it is difficult toobtain the value of d although the values of A and V are known.

Relating to the public key and the private key in the elliptical curvecryptography, the public key is given by the value of V which satisfiesV=dG where G indicates the base point and d indicates the scalar value.That is, the private key V is a point on the elliptical curve, and theprivate key d is a scalar value. Although the point G and V are known byan attacker, it is very difficult to calculate the private key d fromthe point G and V because considerable computational complexity isrequired, which is also known as the computational difficulty of theabove-mentioned discrete logarithm problem.

Furthermore, the ECC is also available for the key agreement by theDiffie-Hellman (DH) algorithm, the digital signature algorithm (DSA),etc. Regardless of the purpose of the use of the ECC, the processperformed using the ECC includes the scalar multiplication as describedbelow with reference to the DH key agreement.

For example, assume that the private key of the first device is d_(A),and the private key of the second device is d_(B). Then, the public keyQ_(A) is calculated by Q_(A)=d_(A)G from the base point G, and thepublic key Q_(B) of the second device is calculated by Q_(B)=d_(B)G fromthe base point G. Thus, the scalar multiplication is performed forgenerating a public key.

The first device transmits its own public key Q_(A) to the seconddevice, and the second device transmits its own public key Q_(B) to thefirst device. Then, the first device calculates the d_(A)Q_(Bb) by thescalar multiplication. As a result, as indicated by the equation (1.9),the first and second devices may share the same key K.K=d _(A) Q _(B) =d _(A)(d _(B) G)=d _(B)(d _(A) G)=d _(B) Q _(A)  (1.9)

When the ECC is used for the purpose other than the DH key agreementexemplified above, the scalar multiplication is also performed.

<Relating to Power Analysis (PA)>

Thus, it is known that the private key d which is difficult to obtainmathematically may be easily disclosed using a power analysis (PA). Thebasic mechanism of the PA is much related to the processing procedure ofthe scalar multiplication on the point of calculating the equation(1.8). In the description below, the PA for the scalar multiplication isexplained after describing the operation procedure of the scalarmultiplication of a point.

The PA is an analyzing method found in 1998 (non-patent document 2). Asillustrated in FIG. 1, it is a method of measuring the power consumptionof a device such as a smart card etc. for which a cryptography functionis being executed (hereafter referred to as an encrypting process), andestimating and analyzing the secret information about a user storedinside the device using the measured data. (FIG. 1)

<Type of PA: Simple Power Analysis (SPA) and Differential Power Analysis(DPA9)>

There are two types of PA, that is, a simple power analysis (SPA), and adifferential power analysis (DPA) (FIG. 2). Any attack is to disclose aprivate key by observing the inner state of a cryptography device usinga power waveform.

The SPA is an aggressive method using a single power waveform. Asillustrated in (a) of FIG. 2, a private key (cryptography key, secretkey) is disclosed by directly observing the contents of the processbeing performed by the cryptography device from the shape of the powerwaveform using the relationship between the contents of the process andthe cryptography key.

The DPA is an aggressive method using the difference among a pluralityof power waveforms. As illustrated in (b) of FIG. 2, a private key(cryptography key, secret key) is disclosed by indirectly observing thedata value processed in the cryptography device from the differenceamong a plurality of power waveforms using the relationship between thecontents of the process and the cryptography key.

As described above, the PA attack is a type of non-destructive attack todisclose a scalar value used as a private key by measuring the powerconsumption of the device which is performing the scalar multiplication.Therefore, regardless of the purpose of the use of the ECC, it iseffective to prevent the power consumption waveform of the device whichis performing the scalar multiplication from expressing thecharacteristic of the private key d as a countermeasure to suppress thereveal of the private key d. If no countermeasure is taken against thePA attack, there is the possibility that the private key d is disclosedfrom the characteristic of the power consumption waveform of the devicewhich is performing the scalar multiplication. Since the SPA and the DPAare aggressive methods of different types, the countermeasure againstboth the SPA and the DPA is to be taken as a countermeasure against thePA.

The encrypting device is designed to be safe against the SPA attack andthe DPA attack, and to minimize the amount of used memory. For easyunderstanding of the merits of the first through third embodiments, somecomparison examples are described below.

<Binary Method (First Comparison Example>

First, as the first comparison example, the “binary method” is describedbelow. The binary method is weak against the SPA attack and the DPAattack.

For example, when the private key d is assigned 160 bits, d may be avery large number (for example, a number close to 2¹⁶⁰). Therefore, itis impractical to perform the scalar multiplication as defined by theequation (1.8) because the addition of a point is performed a largenumber of times. The binary method is to suppress the order of thecomputational complexity for the scalar multiplication to the order ofthe number of bits of the private key d.

FIG. 3 illustrates the algorithm of the binary method in the scalarmultiplication of a point, and FIG. 4 illustrates the outline of theprocess.

For convenience of explanation below, it is assumed that the bit lengthof a private key d is u. It is also assumed that the i-th bit of theprivate key d is d[i] (0≦i≦u−1). d[0] is the least significant bit(LSB), and d[u−1] is the most significant bit (MSB). Then, the u-bitprivate key d is expressed by the equation (2.1).d=d[u−1]∥ . . . ∥d[1]∥d[0]  (2.1)

where “∥” indicates the concatenation of the bit strings of the lengthof 1 bit or more.

Then, the equation (2.2) is obtained from the equation (2.1).dA=2^(u-1) d[u−1]A+ . . . +2¹ d[1]A+2⁰ d[0]A  (2.2)

The binary method is a calculating procedure using the equation (2.2).In the equation (2.2), the bit value d[i] of d is scanned sequentiallyfrom the more significant bits to the less significant bits (that isfrom i=u−1 to 0), and the following equation (2.3) is executed dependingon the bit value d[i] of d.When d[i]=1, an addition(v:=v+a) is performed after doubling(v:=2×v).When d[i]=0, only the doubling(v:=2×v) is performed.  (2.3)

For example, when the case in which the private key d is (1100101)₂ isconcretely described, the binary method realizes the scalarmultiplication by the equation (2.4).dA=2(2(2(2(2(2(2O+A)+A)))+A))+A=2⁶ A+2⁵ A+2² A+A  (2.4)

That is, when the result of the scalar multiplication is expressed bythe variable V, the variable V is initialized first by the infinitepoint of 0 as indicated by the equation (2.5) in the binary method (line301 in FIG. 3)V=O  (2.5)

Then, the equation (2.3) is executed sequentially from the MSB to theLSB (the loop process in lines 302 through 305 in FIG. 3). That is, 2Vis obtained by the doubling (line 303 in FIG. 3). If d[i]=1, theaddition of the point A is performed, and the obtained result issubstituted for the variable V (line 304 in FIG. 3). The process isrepeatedly performed. Then, the value finally obtained as the variable Vis output (line 306 in FIG. 3). “ECDBL(V)” in line 303 in FIG. 3indicates the function process for calculating the doubling of 2V forthe value of variable V. “ECADD(V,A)” in line 304 in FIG. 3 indicatesthe function process for adding the value of the variable A to the valueof the variable V.

Concretely, since d[6]=1 holds true, the doubling and the addition areperformed corresponding to the 6th bit by the equation (2.6) (D6 and A6in FIG. 4).V=2O+A  (2.6)

Then, since d[5]=1 holds true, the doubling and the addition areperformed corresponding to the 5th bit by the equation (2.7) (D5 and A5in FIG. 4).V=2(2O+A)+A  (2.7)

Since d[4]=0 holds true, only the doubling is performed on the 4th bitby the equation (2.8), and no addition is performed (D4 in FIG. 4).V=2(2(2O+A)+A)  (2.8)

Similarly, since d[3]=0 holds true, only the doubling is performed onthe 3rd bit and no addition is performed by the equation (2.9) (D3 inFIG. 4).V=2(2(2(2O+A)+A))  (2.9)

Since d[2]=1 holds true, the doubling and the addition are performed onthe 2nd bit by the equation (2.10) (D2 and A2 in FIG. 4).V=2(2(2(2(2O+A)+A)))+A  (2.10)

Since d[1]=0 holds true, only the doubling is performed on the next 1stbit and no addition is performed by the equation (2.11) (D1 in FIG. 4).V=2(2(2(2(2(2O+A)+A)))+A)  (2.11)

Then, since d[0]=1 holds true, the doubling and the addition areperformed on the last 0th bit by the equation (2.12) (D0 and A0 in FIG.4).V=2(2(2(2(2(2(2O+A)+A)))+A))+A  (2.12)

As described above, the coefficient of the point A added correspondingto the i-th bit where d[i]=1 holds true is 2^(i) as understood from theequation (2.12). Therefore, V=dA is obtained by the equation (2.4)without fail in the procedure exemplified by the equations (2.5) through(2.12).

As clearly indicated by the example above, the frequency of the doublingis equal to the bit length u of the private key d, and the frequency ofthe addition is equal to the Hamming weight of the private key d in thebinary method. Therefore, the computational complexity of the scalarmultiplication in the binary method is suppressed not by the order of2^(u), but by the order of u.

In the binary method, the arithmetic sequence of the doubling and theaddition directly depends on the bit value of d, and the SPA discloses dusing the feature. That is, as illustrated by the power waveform examplein FIG. 5, in the environment in which the difference in process betweenthe addition and the doubling of a point, the following disclosure maybe performed. That is, if the addition is performed after the doubling,the bit value of the index d is disclosed into 1 (501 or 503 in FIG. 5).On the other hand, if only the doubling is performed, the bit value ofthe index d may be disclosed into 0 (502 in FIG. 5). The SPA issuccessfully performed by performing the disclosure on all bits of d.

A method of obtaining a constant arithmetic pattern of the addition andthe doubling regardless of the bit value of d is well known as acountermeasure against the SPA, and the window method described later isalso a method of realizing the countermeasure.

The binary method is also weak against the DPA attack. For easyunderstanding of the explanation about the security against the DPAattack, the basic idea of the DPA attack is described below.

The binary method finally calculates dA while incrementing by 1 the bitof the scalar value (d) from more significant bits as indicated by thefollowing equation to calculate the dA for d=d[u−1]∥ . . . ∥d[1]∥d[0](equation (2.1)).d[u−1]A→(d[u−1]∥d[u−2])A→(d[u−1]∥d[u−2]∥d[u−3])A→

Each time the loop process (302 through 305 in FIG. 3) relating to thevariable i illustrated in FIG. 3 is performed once, the calculationresult with the index incremented by 1 bit is stored in the variable V.

For example, when d=(1101)2 holds true, the calculation is performed bythe following equation.(1)₂ A→(11)₂ A→(110)₂ A→(1101)₂ A

The attacker who performs the DPA repeats identifying whether or not thebit-by-bit prediction of the bits of d using the feature of the binarymethod of “calculating the bit value of a scalar value whileincrementing by 1 the bit value” is correct by a power waveform. In thecase of an attack by a common round-robin method, the disclosure of aprivate key requires the operation proportional to the value of d whilethe DPA may disclose a private key with the operation proportional tothe value of log₂d.

For example, when the most significant bit of d is 0, the data valueexpressed by 0A (mod n) is calculated in the cryptography device, andloaded and stored in the internal memory. On the other hand, when themost significant bit of d is 1, the data value expressed by 1A (mod n)is calculated in the cryptography device, and loaded and stored in theinternal memory.

It is a well-known feature that common hardware including a cryptographydevice consumes the power proportional to the Hamming weight (‘1’) of aloaded and stored data value, and the DPA may discriminate whether theloaded and stored data value is 1A or 0A by using the feature. As aresult, to disclose a bit value less significant by 1 after knowingthat, for example, the most significant bit of d is 1, it isdiscriminated using a similar procedure whether the loaded and storeddata value is (10)₂A or (11)₂A.

The concrete procedure of the DPA is described below in (DPA-1) through(DPA-6).

(DPA-1) The power consumption Pow_(j)(t) (j=1, 2, . . . , L) obtained byinputting V=M_(j) (j=1, 2, . . . , L) as a ciphertext V is measured. Thecharacter t indicates time information.

(DPA-2) The initialization is performed as i:=u−1.

(DPA-3) The attacker predicts the bit value of d[i].

(DPA-4) The attacker calculates the value of the following equation foreach of j=1, 2, . . . , L from the known M_(j), d[u−1]∥ . . . ∥d[i+1]and the predicted d[i].G _(j)=(d[u−1]∥ . . . ∥d[i+1]∥d[i])M _(j)

Depending on the result of the calculation above, L pieces of powerconsumption data Pow_(j)(t) are classified into two groups.

Group 1: a set of Pow_(j)(t) in which the least significant bit of the xcoordinate (or y coordinate whichever is regarded) of G_(j) is 1 forM_(j).

Group 0: a set of Pow_(j)(t) in which the least significant bit of the xcoordinate (or y coordinate whichever is regarded) of G_(j) is 0 forM_(j).

(DPA-5) For the grouped power consumption data as described above, adifferential waveform Diff(t) expressed as follows is generated.(Average of Pow_(j)(t)belonging to group1)−(Average ofPow_(j)(t)belonging to group0)

As a result, when the spike as illustrated by (a) of FIG. 6 appears inthe differential waveform, it is judged that the predicted d[i] iscorrect. When the flat waveform as illustrated by (b) of FIG. 6 appears,it is judged that the predicted k[i] is incorrect.

(DPA-6) When the calculation i:=i−1 is performed, and i≦0 is obtained,there is still a non-disclosed bit, thereby returning control to(DPA-3). When i<0 is obtained, all bit values of display have beendisclosed, thereby terminating the process.

When the prediction of d[i] is correct in DPA-5, the group 0 of thepower consumption in which the least significant bits of the xcoordinates (y coordinates) of the data values expressed by G_(j) areall “0” is subtracted from the group 1 of the power consumption in whichthe least significant bits of the x coordinates (y coordinates) are all“1”, and therefore the power consumption difference of “0” and “1”appears as the spike ((a) in FIG. 6). When the prediction of d[i] isincorrect, the least significant bit of the x coordinate (y coordinate)of G₁ includes the mixture of “0” and “1” in the groups 0 and 1.Accordingly, there is no difference in power consumption, and a flatwaveform appears ((b) in FIG. 6).

As a countermeasure for the DPA, a method of randomizing data asillustrated in FIG. 7 is well known. When there is no countermeasureagainst the DPA, the behavior as illustrated in (a) in FIG. 7 occurs.That is, the sequence of the calculation data valued[u−1]A→(d[u−1]∥d[u−2])A→(d[u−1]∥d[u−2]∥d[u−3])A→ . . . is uniquelydetermined from the value of the private key d[i]. On the other hand, asillustrated in (b) in FIG. 7, the sequence values of the calculationdata are randomized by disturbing the calculation data value usingrandom numbers. Therefore, the relationship between the powerconsumption and the private key is hidden, thereby realizing a safeprocess against the DPA. At the final stage of the operation, anormalizing process is performed for correcting the randomized data, andthe scalar multiplication value of dA is finally obtained. In the method(third comparison example) called a “randomized window method” describedlater, a countermeasure against the SPA is realized based on the windowmethod, and the countermeasure against the DPA may be simultaneouslyrealized by using randomized data in combination.

<Countermeasure Against the PA by Modular Exponentiation ProcessingUsing Window Method (Second Comparison Example)>

As one of the countermeasures against the SPA, a window method is known.As the second comparison example, FIG. 8 illustrates the scalarmultiplication algorithm of a point of the ECC, and FIG. 9 illustratedthe outline of the window method. While a private key d is scanned bitby bit in the binary method, it is scanned every k bits in the windowmethod. For example, when the scalar multiplication is performed on thepoint for d=(101001)₂, the calculation is performed separately in thefollowing order.

Binary method: 1A→(10)₂A→(101)₂A→(1010)₂A→(10100)₂A→(101001)₂A 3-bitwindow method: (101)₂A→(101001)₂A

To perform the operation for every k bits, a private key d is dividedinto k-bit sections. It is performed by storing the divided k-bit valuesin w[i] in the process illustrated in line 806 in FIG. 8.

In the subsequent line 807, the adding process is performed using tabledata tab[w[i]] with w[i] defined as an index value. The table data isexpressed as tab[x], and is the data given by calculating in advance thedata expressed as tab[x]=xA for each of 2^(k) pieces of data of x=0.1, .. . , 2^(k)−1. The value for determination of the table data indexed inthe window method such as w[i] is referred to as a window value, and thesequence of window values such as w[m−1], w[m−2], . . . , w[0] isreferred to as a window sequence.

In the binary method, the “doubling and addition” or the “doubling” isperformed depending on the bit value in the binary method for each bitof a private key d as exemplified in equations (2.5) through (2.12). Onthe other hand, in the window method, the process of “k times ofdoubling and one addition” is constantly performed independent of thebit value for every k bits of a private key d. Therefore, although thepower consumption waveform of the doubling is different from the powerconsumption waveform of the addition, the scalar multiplication in thewindow method is secure against the SPA attack.

For convenience of explanation below, it is assumed that the bit count uof a private key d may be divided by window size k. That is, if m=u/k, mis an integer. For each i in 0≦i≦(m−1), the i-th window value w[i] isdefined by the equation (4.1) (line 806 in FIG. 8).w[i]=d[ik+k−1]∥ . . . ∥d[ik]  (4.1)

The meaning of “[i]” in the notation of “w[i]” indicating the i-thwindow value is different from the meaning of “[i]” in the notation of“d[i]” indicating the i-th bit of a private key d. However, since themeaning of “[i]” is clear from the context, the notation such as “w[i]”is appropriately used in the following descriptions.

For example, when the window size k is assigned 3 bits, and the privatekey d is (011111101)₂, the window value is expressed by the followingequations (4.2) through (4.4).w[2]=(011)₂=3  (4.2)w[1]=(111)₂=7  (4.3)w[0]=(101)₂=5  (4.4)

As described above, in the window method, a scalar multiple xA iscalculated in advance for each x in 0≦x≦2^(k)−1 using the coordinates ofthe point A given as a target of the scalar multiplication. Then, thecalculated scalar multiple xA is stored in the memory as associated withthe index x (lines 802 and 803 in FIG. 8). The scalar multiple xAassociated with the index x is expressed as tab [x] as described above,and tab [x] (=xA) is also referred to as “table data”. In more detail,the table data tab [x] is expressed by a set of x coordinate and ycoordinate of the scalar multiple xA.

When the window size k is assigned 3 bits, the index x may have eightvalues of (000)₂, (001)₂, (010)₂, (011)₂, (100)₂, (101)₂, (110)₂,(111)₂. Therefore, the table data may have eight values as illustratedin (b) in FIG. 9. Tab [(000)₂] (expressed as tab[000] in FIG. 9) may be(000)₂A=infinite point 0 (line 802 in FIG. 8).

As a practical calculating process on the table data tab[x]corresponding to the index x, xA=(x−1)A+A holds true. Therefore, theprocess of adding A to the table data tab[x−1] corresponding to theindex x−1 may be repeatedly performed from x=1 to 2^(k)−1. Thecalculation is performed according to line 803 in FIG. 8. The meaning of“ECADD” is the case according to line 304 in FIG. 3. The initial valueof the table data corresponding to x=0 is calculated astab[0]=tab[(000)₂]=O in line 802 in FIG. 8.

In the window method, the calculation of the point dA is performed usingthe table data by the equation (4.5).dA=2³(2³(2³(O)+tab[(011)₂])+tab[(111)₂])+tab[(101)₂]  (4.5)

To be more concrete, when the result of the scalar multiplication on thescalar value and the point A is expressed by variable V, the variable Vis first initialized by the infinite point 0 by the equation (4.6) (line801 in FIG. 8).V=O  (4.6)

Afterwards, after the process of generating the table data in lines 802and 803 described above, the subsequent loop processing (from line 804to line 808 in FIG. 8) is performed sequentially from i=m−1 to i=0. Thatis, the process of “performing the doubling k times (that is, threetimes) (line 805 in FIG. 8, adding tab[w[i]] (lines 806 and 807 in FIG.8), and substituting the obtained result to the variable V (line 807 inFIG. 8)” is performed. The meaning of “ECDBL” in line 805 in FIG. 8 isthe same as the case in line 303 in FIG. 3.

To be more concrete, the doubling is performed three times, and theaddition is performed once by the equation (4.7) on the window valuew[2] (D2 and A2 in FIG. 9).V=2³(O)+tab[(011)₂]  (4.7)

Next, the doubling is performed three times, and the addition isperformed once by the equation (4.8) on the window value w[1] (D1 and A1in FIG. 9).V=2³(2³(O)+tab[(011)₂])+tab[(111)₂]  (4.8)

Finally, the doubling is performed three times, and the addition isperformed once by the equation (4.9) on the window value w[0] (D0 and A0in FIG. 9).V=2³(2³(2³(O)+tab[(011)₂])+tab[(111)₂])+tab[(101)₂]  (4.9)

Since the table data used in the window method is to be calculateddepending on the input value, the data is stored in the RAM. That is,the larger the bit length k of the window is, the larger the number oftables becomes, thereby increasing the necessary RAM size.

Unlike the binary method, in the window method, the process ofperforming the doubling k times and performing the addition once isconstantly repeated on a point regardless of the bit value (scalarvalue) of a private key d. Therefore, as illustrated in FIG. 10, aprivate key is not disclosed from the waveform of the doubling andaddition on a point, thereby maintaining security against the SPA.

<Countermeasures Against SPA and DPA by Randomized Window Method (ThirdComparison Example)>

Although the SPA may be suppressed by the window method, the DPA is notsuppressed. In the procedure of the DPA by the above-mentioned (DPA-1)through (DPA-6), whether or not the prediction is correct is repeatedlyidentified by a power waveform while predicting the bit of d for eachbit. Based on this, if identifying whether or not the prediction iscorrectly made by a power waveform is repeated as with the case of 1 bitwhile predicting the bit of d for every k bits in the window method,then the application of the DPA to the window method may be realized.Although the computational complexity increases, many k bit values inthe window method may be processed by repeating the process whilevarying the bit number corresponding to the predicted k.

On the other hand, there is a well known method of simultaneouslysuppressing the SPA and DPA by randomizing data in the window method(Patent Document 2). This method is called a randomized window method.FIG. 11 illustrates the difference between the window method as thesecond comparison example and the randomized window method as the thirdcomparison example.

In the randomized window method, table data is randomized by a temporaryrandom number.

That is, in the table data in the common window method, table data isuniquely assigned from the index value x such as tab [x]=xA. On theother hand, in the randomized window method, table data is randomizedusing a random number s which varies each time the scalar multiplicationof a point is performed once such as tab[x]=(2^(b)x+s)A (where sindicates a small integer satisfying a b bit random number).

Since the data is randomized when the scalar multiplication of a pointis calculated by randomizing table data, it is difficult to predict eachbit of a private key d, thereby maintaining security against the DPA.That is, the relationship between the contents of data and the powerconsumption is hidden by the randomization. Thus, the differentialwaveform is not changed by the correctness or incorrectness of theprediction of a bit value by an attacker. Furthermore, like the windowmethod, the operation pattern of the doubling and the addition of apoint is constantly uniform regardless of a private key d, therebymaintaining the security also against the SPA.

As illustrated in FIG. 11, a window sequence w[i] is generated from theprivate key d in the common window method ((a) in FIG. 11). On the otherhand, in the randomized window method, a window sequence w[i] and acorrection value d′ are generated from the private key d and the randomnumber s ((b) in FIG. 11). The correction value d′ is to randomize theintermediate data in the course of an operation and adjust the finaloperation result into dA.

To be more concrete, for example, the index value is processed in thescalar multiplication as is for each of the index values (00)₂, (01)₂,(10)₂, (11)₂ in the k=2 bit window sequence, thereby calculating tabledata in the common window method as illustrated in (a) of FIG. 11. Thatis, (00)₂A, (01)₂A, (10)₂A, (11)₂A (expressed as “00A, 01A, 10A, 11A” inthe attached drawings) are calculated as table data. When the scalarmultiplication is actually performed, table data is acquired with awindow sequence segmented for every k bits from a private key d as anindex, thus performing the adding process.

On the other hand, in the randomized window method, window sequencesw[2], w[1], w[0] and a correction value d′ are generated from theprivate key d and the b bit random number s which is different for eachscalar multiplication operation as illustrated in (b) of FIG. 11. Thecorrection value d′ is to adjust the final operation result into dAwhile randomizing the intermediate data in the course of the operation.That is, first to generate table data, a b bit random number string, forexample, each bit string obtained by concatenating (011)₂ is generatedon the side of a bit string which may appear as the above-mentionedwindow sequence, for example, on the less significant bit side of eachbit string of (00)₂, (01)₂, (10)₂, (11)₂. For example, (00011)₂,(01011)₂, (10011)₂, (11011)₂ are generated. Then, the table dataobtained by performing scalar multiplication on each of the bit strings,for example, (00011)₂A, (01011)₂A, (10011)₂A, (11011)₂A (expressed as(00011)A, (01011)A, (10011)A, (11011)A in the figure) is calculated inadvance. Each calculation result is stored in a table entry using a bitstring which may appear as the window sequence, for example, (00)₂,(01)₂, (10)₂, (11)₂ as an index value. When the scalar multiplicationoperation is actually performed, the table data using the windowsequences w[2], w[1], w[0] generated by the above-mentioned private keyd and random number S as an index is acquired, thus performing theadding process.

Finally, the result obtained by performing the scalar multiplicationusing a correction value d′ generated from the above-mentioned privatekey d and random number s is further added to the final addition result,thereby making an adjustment so that a requested scalar multiplicationvalue dA may be acquired.

Assume that the equation (5.1) holds true with the number of bits of therandom number s defined as b, m as an integer, and the number of bits ofthe private key d as u.u=b+km  (5.1)

It is preferable that the number of bits of the random number S is, forexample, 30 or less. For example, assuming that the private key d is378=(101111010)₂, u=9. Furthermore, assume that the window size k is 2,b is 3, and the random number s is 3=(011)₂. In this case, m=3 by theequation (5.1). In the randomized window method, the k bit window valuew[i] is calculated on each i in 0≦i≦(m−1), and the b bit correctionvalue d′ is calculated so that the equation (5.2) may hold true.

[math  1] $\begin{matrix}{d = {d^{c^{\prime}} + {\sum\limits_{i = 0}^{m - 1}\;{2^{ki}\left( {w\lbrack i\rbrack}||s \right)}}}} & (5.2)\end{matrix}$

Since the random number s is assigned b bits, the equation (5.3) isacquired from the equation (5.2).

[math  2] $\begin{matrix}{d = {d^{c^{\prime}} + {\sum\limits_{i = 0}^{m - 1}\;{2^{{ki} + b}\left( {{w\lbrack i\rbrack} + {2^{ki}s}} \right)}}}} & (5.3)\end{matrix}$

The equation (5.4) is acquired by the transposition of terms from theequation (5.3).

[math  3] $\begin{matrix}{{d - {\sum\limits_{i - 0}^{m - 1}{2^{ki}s}}} = {d^{c^{\prime}} + {\sum\limits_{i - 0}^{m - 1}{2^{{ki} + b}\left( {w\lbrack i\rbrack} \right)}}}} & (5.4)\end{matrix}$

The left side of the equation (5.4) indicates the value calculated fromthe private key d and the random numbers. Then, the right side of theequation (5.4) indicates that the window sequence is acquired bysegmenting the value calculated by the left side of the equation (5.4)in k bit units from the most significant bit, and that the 0 through b+kb least significant bits of the value calculated by the left side of theequation (5.4) are the correction value d′. FIG. 12 illustrates thescalar multiplication algorithm of a point using the randomized windowmethod.

First, the infinite point of 0 is set as an initial value in thevariable V (line 1201 in FIG. 12).

Next, the b bit random number s is generated (line 1202 in FIG. 12).

Using the generated random number s and the coordinates of the point Ato be processed in the scalar multiplication, the table data of theequation (5.5) is calculated according to the algorithm below on each xin 0≦x≦2¹−1 as associated with the index x in advance, and thecalculation result is stored in the memory.tab[x]=(2^(b) x+s)A  (5.5)First as the calculation algorithm, as the initial value, the index 0,for example, the table data tab [0] for (00)₂ is calculated as tab[0]=sA (line 1203 in FIG. 12). The ground for the calculation is thatthe scalar multiplication for the window sequence (00∥s)₂ obtained byconcatenating the random number s to (00)₂ is (00∥s)₂A=sA.

Next, using tab [0] as an initial value, the calculation of the tabledata tab [x] corresponding to the sequentially incremented index x isperformed. The calculating process is performed as follows. That is, thebit string processed in the scalar multiplication is first (x∥s)₂. Then,the equation (x∥s)₂A=(x−1∥s)₂A+sA holds true. Therefore, the table datatab [x] for the index x may be calculated by repeatedly performing theprocess of adding 2^(b)A to the table data tab[x−1] corresponding to theindex x−1 from x=1 to 2^(k)−1. The calculation is performed according toline 1204 in FIG. 12.

For example, when b=3 and s=(011)₂=3 hold true as described above, thememory stores the data of the following equations (5.6) through (5.9) astable data.tab[(00)₂]=tab[0]=(2³×0+3)A=3A  (5.6)tab[(01)₂]=tab[1]=(2³×1+3)A=11A  (5.7)tab[(10)₂]=tab[2]=(2³×2+3)A=19A  (5.8)tab[(11)₂]=tab[3]=(2³×3+3)A=27A  (5.9)

Next, the window sequences w[m−1], . . . , w[0] and the correction valued′ are calculated with the private key d and the random number S asinput by the above-mentioned equation (5.4) (line 1205 in FIG. 12).

For example, when d=378=(101111010)₂ holds true and the random number sis 3=(011)₂, the left side of the equation (5.4) is calculated by theequation (5.10).378−(2⁰×3+2²×3+2⁴×3)=378−(3+12+48)=315=(100111011)₂   (5.10)

Therefore, the window sequences w[2], w[1], w[0] are obtained bysegmenting the value (100111011)₂ obtained by the equipment (5.10) in2-bit units. In addition, the correction value d′ is obtained from theb=3 least significant bits of the value (100111011)₂. Concretely, it isobtained by the equations (5.11) through (5.14).w[2]=(10)₂=2  (5.11)w[1]=(01)₂=1  (5.12)w[0]=(11)₂=3  (5.13)d′=(011)₂=3  (5.14)

In the randomized window method, the window sequence w[i] (0≦i≦m−1) andthe correction value d′ are calculated as described above.

As described above, after obtaining table data, a window sequence, and acorrection value, the scalar multiplication dA of the point A isactually performed. In more detail, the following loop process (fromline 1206 to line 1209 in FIG. 12) is performed from i=m−1 to i=0, andthen the process in line 1210 is finally performed. That is, as the loopprocess, the process of performing doubling k times (for example, threetimes) (line 1207 in FIG. 12), adding tab [w[i]], and substituting theobtained result for the variable V (line 1208 in FIG. 12) is performed.Then, after the loop process, the scalar multiplication d′ A iscalculated by the correction value d′, and the calculation result isadded to the variable V (line 1210 in FIG. 12).

Concretely, for example, the calculation by the following equation(5.15) is performed.

$\begin{matrix}\begin{matrix}{{dA} = {{2^{2}\left( {{2^{2}\left( {{2^{2}(O)} + {{tab}\left\lbrack {w\lbrack 2\rbrack} \right\rbrack}} \right)} + {{tab}\left\lbrack {w\lbrack 1\rbrack} \right\rbrack}} \right)} + {{tab}\left\lbrack {w\lbrack 0\rbrack} \right\rbrack} + {d^{\prime}A}}} \\{= {{4\left( {{4\left( {{4(O)} + {19A}} \right)} + {11A}} \right)} + {27A} + {3A}}} \\{= {{4\left( {{4\left( {O + {19A}} \right)} + {11A}} \right)} + {27A} + {3A}}} \\{= {{4\left( {{4\left( {19A} \right)} + {11A}} \right)} + {27A} + {3A}}} \\{= {{4\left( {{76A} + {11A}} \right)} + {27A} + {3A}}} \\{= {{4\left( {87A} \right)} + {27A} + {3A}}} \\{= {{348A} + {27A} + {3A}}} \\{= {378A}}\end{matrix} & (5.15)\end{matrix}$

Since the correction value d′ in the equation (5.14) is calculated bythe equation (5.4) to satisfy the equation (5.2), dA (that is, 378A inthis example) is obtained by the calculation by the equation (5.15).

By the equation (5.15), the process of performing the doubling k times(k=2 in the example above) and performing the addition once is repeatedm times (m=3 in the example above) regardless of the bit value of theprivate key d, and the scalar multiplication is performed once using thecorrection value d′ and the addition of the point A is performed.Therefore, the randomized window method is secure as with the windowmethod against the SPA attack. Furthermore, since the table data israndomized by the random number s, the randomized window method is alsosafe against the DPA attack.

<Reduction of Table Data by Signed Window Method (Fourth ComparisonExample)>

In the window method or the randomized window method, 2^(k) entries aregenerated in the table depending on the window size k. On the otherhand, in a certain type of device such as an incorporated equipment unitwhich has a small memory capacity, it is preferable that the amount ofthe used memory is reduced to perform various processes.

An example of the incorporated equipment unit is a smart card. Anotherexample of the incorporated equipment unit is a part authenticated by anelectronic equipment unit such as a printer etc. For example, to removea forged product, a large scale integration (LSI) called a“authentication chip” may be incorporated into an accessory part such asa secondary battery, a printer cartridge, etc. The authentication of aprinter cartridge by a printer may be performed to disable the printingon, for example, a printer cartridge other than a standard product.Obviously, the incorporated equipment unit includes many other varioustypes.

For example, especially in a device such as a smart card, a printercartridge with an authenticating function, etc., the available memorycapacity is small. Therefore, it is preferable to use a processalgorithm with a reduced amount of used memory in a scalarmultiplication.

Then, as the fourth comparison example, the signed window method isdescribed below. The signed window method is secure against the SPAattack as with the window method, and requires less amount of usedmemory than the window method.

The above-mentioned window method may be applied to RS cryptography(modular exponentiation operation), but there is a method of reducingthe table data approximately by half by specializing the process intothe ECC (scalar multiplication of a point). It is a method called a“signed window method”.

That is, the signed window method is a medium in which the process loadof the calculation for obtaining an inverse element point of −A from thepoint A on an elliptical curve is relatively light (that is, thecalculation cost of the inverse element is low) (refer to equations(1.4) and (1.5), and the description of them).

FIG. 13 illustrates the comparison between the common window method ((a)in FIG. 13) and the signed window method ((b) in FIG. 13). When the bitlength of the window is k, 2^(k) pieces of table data is required forthe bit length k of the window in the common window method. On the otherhand, in the signed window method, the size of the RAM required to storethe table data may be halved because 2^(k-1)+1 pieces of table data isacceptable.

In the case of the 3-bit window method illustrated in (a) of FIG. 13,eight pieces of table data, that is, 0A, 1A, . . . , 7A, are required.On the other hand, in the case of the 3-bit signed window methodillustrated in (b) of FIG. 13, five pieces of table data, that is, 0A,1A, . . . , 4A are required. That is, the 3-bit signed window method mayreduce three pieces of table data as compared with the 3-bit windowmethod. In the common window method, a private key d is divided intok-bit units as window values as is. On the other hand, in the signedwindow method, the private key dissimilarly divided into k-bit units.However, when the value is a constant value (2^(k-1) or 2^(k-1)+1 ormore), 2^(k) is subtracted from the window value (correcting thewindow). To cancel the negative influence, 1 is added to the windowvalue which is one more significant window value (carry correction). Inthe case of the 3-bit signed window method in (b) of FIG. 13, in eachwindow value obtained by the 3-bit division, 8 is subtracted from thewindow value if it is four or more. By the subtraction, 4A, 5A, 6A, and7A are changed into −4A, −3A, −2A, and −1A. However, the calculation maybe performed by executing the subtraction of a point using the tabledata of 4A, 3A, 2A, and 1A, thereby requiring no table of 5A, 6A, and7A.

The scalar value obtained by subtracting 2^(k) from the window value,that is, the window value −2^(k) is −(2^(k)−window value). Then,(2^(k)−window value) is equal to the complement of 2 for the windowvalue. Therefore, (window value−2^(k)) is −(complement of 2 for thewindow value). That is, the scalar multiplication value of the point Ausing the scalar value obtained by subtracting 2^(k) from the windowvalue is equal to the value obtained by adding a minus sign to theoperation result of the scalar multiplication of the point A using thecomplement of 2 for the window value as a scalar value. When the windowvalue is 2^(k-1) or 2^(k-1)+1 or more, the complement of 2 isnecessarily 2^(k-1) or less or 2^(k-1)−1 or less.

The 2^(k-1)A is calculated from the scalar multiplication value 0A for2^(k-1)+1 scalar values whose window values are 0 through 2^(k-1) inadvance, and stores the results in each entry of the table using each ofthe window values 0 through 2^(k-1) as an index value. The scalarmultiplication value of the point A using the scalar value obtained bysubtracting 2^(k) from the window value in the case in which the windowvalue is 2^(k-1) or 2^(k-1)+1 or more may be obtained as follows. Thatis, the table storing 2^(k-1)A is referred to and an operation result ofa corresponding scalar multiplication value is acquired from theoperation result OA of the above-mentioned 2^(k-1)+1 scalarmultiplication values using the complement of 2 corresponding to thewindow value as an index value, and a minus sign is added to theacquisition result. Obviously, when the window value is 2^(k-1)+1 orless than 2^(k-1)+1, the operation result of the corresponding scalarmultiplication value may be acquired by referring to the table storing2^(k-1)A from the operation result OA of the 2^(k-1)+1 scalar valuesusing the window value as is as an index value. Thus, the table size maybe reduced to 2_(k-1)+1.

For example, assume that the window size k is 3. Then, the number ofindexes used in the signed window method is five, that is, 0, 1, 2, 3,and 4. The table data corresponding to the five indexes is 0A, 1A, 2A,3A, and 4A. In the signed window method, the table data 5A, 6A, and 7Acorresponding to the three indexes 5, 6, and 7 are omitted by using therelationship among the subsequent equations (6.1) through (6.3).5A=2^(k) A−3A=8A−3A  (6.1)6A=2^(k) A−2A=8A−2A  (6.2)7A=2^(k) A−1A=8A−1A  (6.3)

For example, assume that the window size k is 3 bits, and the privatekey d is 241=(011110001)₂. In the signed window method, first as withthe window method, a provisional window value is obtained. That is, theprovisional window value is expressed by the following equations (6.4)through (6.6). Since there is no possibility of disorder, theprovisional window value and an actually determined window value areboth expressed as w[i].w[2]=(011)₂=3  (6.4)w[1]=(110)₂=6  (6.5)w[0]=(001)₂=1  (6.6)

Then, the provisional window value is scanned sequentially from theleast significant bit (that is, w[0]), and each window value isdetermined as follows. That is, if w[i]≧2^(k-1)+1 holds true, the valueobtained by subtracting 2^(k) from the provisional window value w[i](that is, w[i]−2 ^(k)) is set as a window value w[i]. When 2^(k) issubtracted from the i-th provisional window value w[i], 1 is added tothe one more significant provisional window value w[i+1] to cancel theinfluence of the subtraction.

In the following description, the above-mentioned subtraction of 2^(k)is referred to as “window correction”, and the above-mentioned additionof 1 is referred to as “carry correction”. The condition ofw[i]≧2^(k-1)+1 above may be replaced with the condition of w[i]≧2^(k-1),but for convenience of explanation below, it is assumed that thecondition of w[i]≧2^(k-1)+1 is used.

The actual window value may be obtained from the provisional windowvalue in equations (6.4) through (6.6) as follows.

That is, by the equation (6.6), w[0]<2^(k-1)+1 holds true. Therefore,the 0-th (that is, the least significant) window value w[0] is 1 as withthe provisional window value.

By the equation (6.5), w[1]≧2^(k-1)+1 holds true. Therefore, the firstwindow value is obtained by subtracting 8 (=2^(k)) from the provisionalwindow value 6, and determined as w[i]=−2. Accordingly, 1 is added tothe provisional window value w[2] in the equation (6.4) by carrycorrection, thereby obtaining w[2]=4.

The provisional window value w[2]=4 which has been carry-correctedsatisfies the expression w[2]<2^(k-1)+1. Therefore, the second (that is,the most significant) window value is determined as w[2]=4.

Using the window values w[0] through w[2] determined as described above,the point dA is calculated by the equation (6.7) in the signed windowmethod.dA=2³(2³(2³(O)+tab[w[2]])−tab[−w[1]])+tab[w[0]]  (6.7)

To be more concrete, when the result of the scalar multiplication isexpressed by the variable V, the variable V is first initialized by theinfinite point 0 by the equation (6.8).V=O  (6.8)

Afterwards, the process of performing the doubling k times, adding tab[w[i]] if the window value w[i] is 0 or more, subtracting tab[−w[i]] ifthe window value w[i] is negative, and substituting the obtained resultfor the variable V is performed sequentially from i=m−1 to i=0. Thevalue of m is obtained by dividing the bit length u of the private key dby the window size k, and m=3 holds true in the present embodiment.

After the initialization of the equation (6.8), the processcorresponding to i=m−1 is performed. That is, the doubling is performedthree times and the addition is performed once according to the equation(6.9) corresponding to the window value w[2] (=4).V=2³(O)+tab[w[2]]  (6.9)

Next, for the window value w[1] (=−2), the doubling is performed threetimes and the subtraction is performed once according to the equation(6.10).V=2³(2³(O)+tab[w[2]])−tab[−w[1]]  (6.10)

Finally, for the window value w[0] (=1), the doubling is performed threetimes and the subtraction is performed once according to the equation(6.11).V=2³(2³(2³(O)+tab[w[2]])−tab[−w[1]])+tab[w[0]]  (6.11)

The right side of the equation (6.11) is expanded as indicated by thefollowing equation (6.12). Furthermore, in the present embodiment, theprivate key d is 241. Therefore, it is understood that the point dA iscorrectly calculated in the signed window method described above.

$\begin{matrix}\begin{matrix}{V = {{2^{3}\left( {{2^{3}\left( {{2^{3}(O)} + {{tab}\lbrack 4\rbrack}} \right)} - {{tab}\lbrack 2\rbrack}} \right)} + {{tab}\lbrack 1\rbrack}}} \\{= {{2^{3}\left( {{2^{3}\left( {4A} \right)} - {2A}} \right)} + {1A}}} \\{= {{8\left( {{32A} - {2A}} \right)} + {1A}}} \\{= {241A}}\end{matrix} & (6.12)\end{matrix}$

The signed window method is secured against the SPA attack, but is weakagainst the DPA attack for the reason similar to the window method.

<Study of Signed Random Window Method (Third+Fourth Comparison Example)>

The first through fourth comparison examples are described above, butthe randomized window method which is secured against both the SPAattack and the DPA attack uses relatively, a large amount of memory, andthe signed window method which uses a small amount of memory is weakagainst the DPA attack. That is, in the above-mentioned four comparisonexamples, there is no method having the feature of being secured againstboth the SPA attack and the DPA attack, and requiring a small amount ofthe memory.

On the other hand, there is the possibility that the PA attack which isa type of side channel attack occurs on an incorporated equipment unit,and some incorporated equipment units have limited capacity of memory.Therefore, it is preferable that the process of scalar multiplication bya device of a small memory capacity such as an incorporated equipmentunit is secured against both the SPA attack and the DPA attack, andrequires a small amount of memory.

However, according to the study of the Applicant of the presentinvention, it is clear that the feature of being secured against boththe SPA attack and the DPA attack, and requiring a small memory capacityis not obtained by simply combining the randomized window method and thesigned window method. On the contrary, the Applicant has found that therandomized window method and the signed window method are not allowed tobe simply combined with each other. The details are described below.

When a random number is used, a simple application of the signed windowmethod is rejected. Therefore, when the randomized window method isadopted as a countermeasure against the SPA attack, the reduction of theamount of used memory is not performed by the simple application of thesigned window method. That is, the attempt to acquire the securityagainst both the SPA attack and the DPA attack by a small memorycapacity by combining the signed window method and the randomized windowmethod it not successfully executed.

The finding is described below in more detail.

It is difficult to realize the scalar multiplication on a point havingthe security against the SPA and the DPA by combining the signed windowmethod as the fourth comparison example with the randomized windowmethod as the third comparison example. For example, the exampleillustrated in FIG. 14 is described below. The following procedures 1through 5 respectively correspond to the procedures 1 through 5 in FIG.14.

1. Since 110 is obtained in the third window from the most significantbit, the window value is set as 010, and the subtracting process isperformed on the point when the scalar multiplication process isperformed. In this case, s in the sequence becomes −s (+s→−s).

2. Since the third window value is set as 010, one bit carry isgenerated in the second window value.

3. By the carry generated in the procedure 2, +1 is added to the secondwindow value, thereby resulting in 100.

4. Since the third window value is 100 in the procedure 3, −4A isreferred to, thereby changing the sign of s (+s→−s).

5. Since the second s has become −s in the procedure 4, it is differentfrom s (+s) which is predicted when the third window value is determinedin the procedure 1. Therefore, the third window value is not determined.

As described above, the window value is not uniquely determined withrespect to the algorithm in which the window value is determined fromthe most significant bit to the least significant bit.

The explanation above may be summarized as the table in FIG. 15. First,the randomized window method as the third comparison example iseffective against the SPA attack (and also the SPA attack), its carrycontrol is simple, but the table size is as large as 2^(k). On the otherhand, the signed window method as the above-mentioned fourth comparisonexample is simple in carry control, has the table size as small as2^(k-1)+1, but is weak against the DPA attack. Then, the randomizedwindow method as the third comparison example is not combined with thesigned window method as the fourth comparison example by a simplemethod. That is, a method in which a table size may be about half(2^(k-1)+1) of the size of the normal window method is not realized by asimple combination.

The present application provide a method which is secured against theDPA and in which simple carry control may be realized with a half tablesize (2^(k-1)+1) as compared with the normal window method.

To solve the problem, the present application provides the followingfeatures.

A sequence of (s∥window values)

Generating a window value based on the application method from the leastsignificant bit to the most significant bit

Using the sequence of (s∥window values) as the first feature, theintermediate result obtained in the window method is randomized.Therefore, the security against the DPA is maintained. Furthermore, thewindow method also maintains the security against the SPA.

In addition, by generating a window value according to the algorithmdescribed later from the least significant bit to the most significantbit based on the second feature, a secured scalar multiplication may berealized in a simple method which is free of carry control.

FIG. 16 is the first hardware configuration example of an encryptingdevice according to the first through third embodiments of the presentinvention.

An encrypting device 1600 in FIG. 16 includes a central processing unit(CPU) 1601, read only memory (ROM) 1602, random access memory (RAM)1603, a communication circuit 1604, and a communication interface (I/F)1605.

The CPU 1601, the ROM 1602, the RAM 1603, and the communication circuit1604 are interconnected to one another through a bus 1606. Theencrypting device 1600 includes a power supply terminal 1607 and aground terminal 1608, and a power voltage is supplied to each unit inthe encrypting device 1600 through the wiring not illustrated in theattached drawings and the power supply terminal 1607. Each unit in theencrypting device 1600 is also connected to the ground terminal 1608through the wiring not illustrated in the attached drawings.

The CPU 1601 loads into the RAM 1603 a program stored in advance in theROM 1602, and executes the program using the RAM 1603 as a working area,thereby performing various processes. For example, the CPU 1601 performsa control process illustrated in the flowcharts in FIGS. 20, 22, 23, 25,26, and 28.

The ROM 1602 may be replaced with another type of non-volatile memorysuch as flash memory etc. When a rewritable storage device such as flashmemory replaces the ROM 1602, the program may be downloaded into theencrypting device 1600 through the communication I/F 1605, and installedto the encrypting device 1600.

The encrypting device 1600 may communicate with other devices throughthe communication I/F 1605. For example, the encrypting device 1600 maytransmit the information about a public key etc. of the encryptingdevice 1600 itself to other devices through the communication I/F 1605,and receive the information about a public key of another device throughthe communication I/F 1605.

The type of the communication I/F 1605 may be any type depending on thetypes of the encrypting device 1600. For example, the encrypting device1600 may be a smart card, an LSI chip incorporated into an accessorypart such as a printer card etc., and an LSI chip incorporated into adomestic electric appliance. For example, when the encrypting device1600 is a contact type smart card, the communication I/F 1605 mayinclude a communication terminal. When the encrypting device 1600 isanon-contact smart card, the communication I/F 1605 may include anantenna.

The communication circuit 1604 performs an appropriate process dependingon the type of the communication I/F 1605 and communication protocol.For example, the communication circuit 1604 may perform the processessuch as a digital to analog conversion, an analog to digital conversion,modulation, demodulation, coding, decoding, etc.

An attacker who attempts the PA attack inputs data of a point on anelliptical curve to the encrypting device 1600 through the communicationI/F 1605, and measures the power consumption while the encrypting device1600 is performing a process on the input point, thereby estimating theprivate key of the encrypting device 1600. For example, the attackerconnect a resistor to the power supply terminal 1607, thereby measuringthe power consumption.

FIG. 17 is the second hardware configuration example of an encryptingdevice according to the first through third embodiments. An encryptingdevice 1610 in FIG. 17 includes an ECC hardware circuit 1611 instead ofthe CPU 1601 and the ROM 1602.

Furthermore, the encrypting device 1610 includes the RAM 1603, thecommunication circuit 1604, and the communication I/F 1605 which aresimilar to those of the encrypting device 1600 in FIG. 16. In theencrypting device 1610, the ECC hardware circuit 1611, the RAM 1603, andthe communication circuit 1604 are interconnected through the bus 1606.The encrypting device 1610 also includes the power supply terminal 1607and the ground terminal 1608 which are similar to those of theencrypting device 1600 in FIG. 16.

In the encrypting device 1610, instead of the CPU 1601 which reads theprogram from the ROM 1602 and executes it, the ECC hardware circuit 1611performs the control process illustrated in the flowcharts in FIGS. 20,22, 23, 25, 26, and 28. The ECC hardware circuit 1611 may be, forexample, an application specific integrated circuit (ASIC), or at leasta part of the ECC hardware circuit 1611 may be realized by a fieldprogrammable gate array (FPGA). Furthermore, the ECC hardware circuit1611 is connected to the power supply terminal 1607 and the groundterminal 1608 through the wiring not illustrated in the attacheddrawings.

Depending on the embodiments, the encrypting device may include the CPU1601 in FIG. 16 as a general-purpose processor, the ROM 1602 in FIG. 16which stores a program executed by the CPU 1601, and the ECC hardwarecircuit 1611 in FIG. 17 as a co-processor. Then, the CPU 1601 performs apart of the controlling process illustrated by the flowcharts in FIGS.20, 22, 23, 25, 26, and 28, and another part may be performed by the ECChardware circuit 1611. Also in this case, the encrypting device includesthe RAM 1603, the communication circuit 1604, and the communication I/F1605 as illustrated in FIGS. 16 and 17.

FIGS. 18 and 19 are explanatory views of the configuration of thefunction of the encrypting device according to the first through thirdembodiments of the present invention. A window value determination unit1800 illustrated in FIG. 18, and a scalar multiplication unit 1900 for apoint as illustrated in FIG. 19 may be realized by the hardwareexemplified in FIG. 16 or 17.

First, the window value determination unit 1800 in FIG. 18 includes arandom number generation unit 1801, a window value determination unit1802, a correction value calculation unit 1803, a control unit 1804, awindow value storage unit 1805, a correction value storage unit 1806,and a random number storage unit 1807.

The random number generation unit 1801 generates a 2-bit binary randomnumber s.

The window value determination unit 1802 retrieves the least significantk bits of the current secret key d using (b+m×k) bit binary secret key das the initial value, and performs a calculation as a binary windowsequence w(i).

The correction value calculation unit 1803 obtains a binary bit stringx=(s∥w(i)) obtained by concatenating the random number s on the moresignificant bit side of the window sequence w(i) if the most significantbit of the window sequence w(i) is 0, subtracts the bit string x fromthe current secret key d, and acquires a bit string of a new secret keyd. In addition, if the most significant bit of the window sequence w(i)is 1, then the correction value calculation unit 1803 calculates the bitstring v of the complement of the base for the window sequence w(i) inbinary. Then, a bit string −x=−(s∥v) assigned a minus sign to the bitstring obtained by concatenating the random number s to the moresignificant bit side of the bit string v is obtained, the bit string −xis subtracted from the current secret key d, and a bit string of a newsecret key d is obtained.

The control unit 1804 repeatedly performs the process of the windowvalue determination unit 1802 and the process of the correction valuecalculation unit 1803 until i reaches 0 or until the point immediatelybefore the value of the bit string of the secret key d becomes anegative value while changing i from m−1 to 0.

The window value storage unit 1805 stores each window sequence w(i)obtained after the operation by the control unit 1804 is completed.

The correction value storage unit 1806 stores as a correction value d′the bit string of the secret key d obtained after the operation of thecontrol unit 1804 is completed.

The random number storage unit 1807 stores the random number s generatedby the random number generation unit 1801

Next, the scalar multiplication unit 1900 of the point illustrated inFIG. 19 includes a randomized table generation unit 1901, a signed andrandomized window method calculation unit 1902, and a control unit 1903.The scalar multiplication unit 1900 performs an encrypting operation onthe point A on the elliptical curve by the secret key d from the randomnumber s calculated by the window value determination unit 1800 in FIG.18 corresponding to the (b+m×k) bit binary secret key d in theelliptical curve cryptography, each window sequence w(i), and thecorrection value d′ (in this example, b, m, k, i, and j are naturalnumbers including 0).

The randomized table generation unit 1901 performs the scalarmultiplication on the point A using as a scalar value the index valueobtained by concatenating the random number s on the more significantbit side of the k-bit bit string while sequentially changing the valueof the bit string of the number k of bits corresponding to the number ofbits of the window sequence w(i), and the calculation result of thescalar multiplication is stored as table data corresponding to the indexvalue, thereby generating a randomized table.

The signed and randomized window method calculation unit 1902 sets as aninitial value of the output variable V the calculation result obtainedby performing the scalar multiplication on the point A using thecorrection value d′ as a scalar value. Then, the signed and randomizedwindow method calculation unit 1902 repeatedly performs a series of thefirst and second processes below on each window sequence w(j) from themore significant bits side to the less significant bits. That is, thesigned and randomized window method calculation unit 1902 performs thedoubling on the elliptical curve the number of times k corresponding tothe number of bits of each window sequence as the first process. Next,as the second process, the signed and randomized window methodcalculation unit 1902 acquires the table data in the randomized tableusing the window sequence w(j) as an index if the most significant bitof the window sequence w(j) is 0, and adds the data to the outputvariable V. On the other hand, if the most significant bit of the windowsequence w(j) is 1, the unit acquires the table data in the randomizedtable using as an index the bit string of the complement of the base forthe window sequence w(j) in binary, and adds the value obtained byadding a minus sign to the output variable V.

The control unit 1903 controls the repeated operation on each windowsequence w(j) by the signed and randomized window method calculationunit 1902 from the more significant bits side to the less significantbits side.

Then, the control unit 1903 outputs as a result of the encryptingoperation the value of the output variable V finally obtained as aresult of the repetitive operation above.

In FIGS. 18 and 19, the random number generation unit 1801, the windowvalue determination unit 1802, the correction value calculation unit1803, the control unit 1804, the randomized table generation unit 1901,the signed and randomized window method calculation unit 1902, and thecontrol unit 1903 may be realized as the following configuration. Thatis, each of these units may be the process performed by the CPU 1601 inFIG. 16, may be the process performed by the ECC hardware circuit 1611in FIG. 17, and may be the process performed by the combination of theCPU 1601 and the ECC hardware circuit 1611. In this case, the programfor executing the processes may be executed by being stored in the ROM1602 or the RAM 1603 in FIG. 16 or 17. Furthermore, the secret key d maybe stored in the ROM 1602 in FIG. 16 or 17. In addition, the windowvalue storage unit 1805, the correction value storage unit 1806, and therandom number storage unit 1807 in FIG. 18 may be stored in, forexample, the RAM 1603 in FIG. 16 or 17.

In FIG. 19, the point A may be given from the device other than theencrypting device according to the first through third embodiments tothe encrypting device according to the first through third embodiments.For example, the point A may be a public key of an external device. Thepublic key of the external device may be notified from, for example, theexternal device to the encrypting device according to the first throughthird embodiments for a DH key agreement, and may be notified from theexternal device to the encrypting device according to the first throughthird embodiments for the authentication by the DSA.

When the point A is given from the device other than the encryptingdevice according to the first through third embodiments to theencrypting device according to the first through third embodiments, thepoint A is acquired by the communication I/F 1605 and the communicationcircuit 1604.

The control unit 1903 in FIG. 19 performs an appropriate process usingthe xy coordinates of the value of the output variable V. For example,the control unit 1903 may transmit the point V to another device, mayperform the process for authentication by the DSA, and may perform theprocess for a DH key agreement. The control unit 1903 may output thepoint V externally using the communication circuit 1604 and thecommunication I/F 1605 depending on the case. For example, if theencrypting device according to the first through third embodiments isincluded in the accessory parts (for example, a printer cartridge etc.)authenticated by the host device (for example, a printer etc.), then thecontrol unit 1903 includes the communication circuit 1604 forcommunication with the host device and the communication I/F 1605.

Described next below is the first embodiment of the concrete process ofthe window value determination unit 1800 in FIG. 18 and the scalarmultiplication unit 1900 on a point in FIG. 19.

FIGS. 20A and 20B are a flowchart of the window value determinationalgorithm according to the first embodiment which illustrates theprocess of the window value determination unit 1800 in FIG. 18. Theprocess according to the flowchart is described below.

As an input, the process is started upon input of the (b+m×k) bit binarysecret key d=d[b+m×k]∥ . . . ∥d[1]∥d[0] in the elliptical curvecryptography where k indicates the number of bits of the window value, mindicates the number of window sequences, and b indicates the number ofbits of the random number s.

Then, the b-bit binary random number s is first generated (step 2201).It corresponds to the function of the random number generation unit 1801in FIG. 18.

Next, the value of the variable i is initialized to m−1, and the valueof the variable L is initialized to 0 (step 2202).

Next, the k least significant bits are retrieved from the bit string ofthe current secret key d, and is defined as the window sequence w(i)(step 2203). It corresponds to the function of the window valuedetermination unit 1802 in FIG. 18.

Next, it is determined whether or not the most significant bit (MSB) inthe window sequence w(i) is 1 (step 2204).

If the most significant bit in the window sequence w(i) is 0, a binarybit string x=(s∥w(i)) is obtained by concatenating the random number son the more significant bits side of the window sequence w(i) (steps2204→2205).

Then, the bit string x is subtracted from the current secret key d, andit is determined whether or not the subtraction result is smaller than 0(step 2220).

Unless the subtraction result is smaller than 0, the subtraction resultabove is defined as the bit string of a new secret key d (step2220→2206).

The case in which the subtraction result is smaller than 0 is describedlater.

On the other hand, when the most significant bit of the window sequencew(i) is 1, the bit string v of the complement of the base for the windowsequence w(i) in binary system is calculated (step 2207). To be moreconcrete, each bit of the window sequence w(i) is inverted bycalculating the exclusive OR (XOR) for each corresponding bit betweenthe window sequence w(i) and the bit string 2^(k)−1, 1 is added to theinversion result, and the addition result is set as v.

Next, the random number s is combined on the more significant bits sideof the bit string v, thereby obtaining the bit string x=(s∥v) (step2208).

Then, the bit string −x obtained by adding a negative sign to the bitstring x is subtracted from the current secret key d, thereby obtainingthe bit string of a new secret key d. That is, the calculation isperformed by d=d−(−x)=d+x (step 2206′).

The series of processes in steps 2204 through 2209 correspond to thefunction of the correction value calculation unit in FIG. 18.

Next, when a new secret key d is calculated in step 2206 or 2206′, thebit string of the secret key d is right shifted by k bits, and the kleast significant bits are truncated (step 2210). In this example, d>>kindicates the operation of right-shifting the secret key d by k bits.

Next, the value of the variable i is subtracted by 1 (step 2211).

Then, it is judged whether or not the value of the variable i is 0 ormore (step 2212).

If the value of the variable i is 0 or more, control is returned to step2203, and the series of processes from step 2203 to step 2209 areperformed (step 2212→2203).

When the value of the variable i is 0 or less, control is passed to step2213 (step 2212→2213).

Furthermore, when the value of d−x is 0 or less in step 2220, control ispassed to step 2213 after the value of the current i+1 is set as thevalue of the variable L (step 2220→2221). The process is describedlater.

The controlling process in steps 2210 through 2212, 2220, and 2221corresponds to the function of the control unit 1804 in FIG. 18.

Finally, the value of the current secret key d is set as the correctionvalue d′ (step 2213).

Then, the finally obtained window sequences w[0] through w[m−1], therandom number s, the correction value d′, and the value of the variableL indicating the window starting position are output, therebyterminating the process of the window value determination algorithm.

A concrete calculation example of the process of the window valuedetermination algorithm according to the first embodiment is describedbelow with reference to the explanatory view in FIG. 21.

First, k indicates a bit length of a window value as described above,and a parameter t be determined in advance; and b indicates a bit lengthof a random number s as described above, and a parameter fordetermination of a minimum value in advance. The value of m depends onthe length (u) of the secret key d, k, and b. For example, the valuesare determined as follows.[math 4]h=u−b  1.m=└h/k┘  2.b=u−k×m  3.

where b depends on the determined value of m.

There may be another example as listed below.[math 5]h=u−b  1.m=┌h/k┐  2.b=u−k×m  3.

There may be a further example below.[math 6]h=u−b  1.m=└h/k┘  2.b=b  3.

There may be a further example below.[math 7]h=u−b  1.m=┌h/k┐  2.b=b  3.

There are many other deriving methods.

There is a following example of a recommended parameter length.

k=2, 3, 4, 5, etc.

b=10, 12, 16, 20, 30, 40, 50, 60, 70, 80, 90, 100, etc. for arbitrarylengths

length of d: u=512, 1024, 2048, 3072, 4096,

160, 192, 224, 256, 384, 521, 163, 233, 239, 283, 409, 571, etc.

Assume an elliptical curve cryptography calculating process when, forexample, k=2, b=4, d=(10110111001011)₂, (length of d: u=14 bits). Inthis case,h=u−b=10m=5b=u−k×m=14−2×5=4(no change)

according to the calculation example by math 4.

Under the condition, first in step 2201, for example, (1011)₂ isgenerated as a b=4 bit random number.

Next, in step 2202, the initialization is performed for i=m−1=5−1=4,L=0.

Next, in step 2203 in the first cycle, the 2 least significant bits ofdare retrieved and assigned w[4]=(11)₂ as illustrated in FIG. 21.

Next, in step 2204 in the first cycle, it is judged that the mostsignificant bit of w[4] is 1.

As a result, in step 2207 in the first cycle, the complement of 2 iscalculated for w[4]=(11)₂, thereby obtaining v=(01)₂.

Next, in step 2208 in the first cycle, x=(s∥v)=(101101)₂ is calculated.

Then, in step 2209 in the first cycle, the value −x obtained by adding aminus sign to x illustrated in FIG. 21 is subtracted from the value ofthe current secret key d. That is, a new secret key d is calculated asd=d−(−x)=d+x=(10110111001011)₂+(101101)₂=(10110111111000)₂.

Next, in step 2210 in the first cycle, the secret key d above is 2 bitsright-shifted. That is, d=d>>2=(101101111110)₂ is calculated.

Next, in step 2211 in the first cycle, 1 is subtracted from the value ofthe variable i. That is, i=i−1=3.

Next, in step 2212 in the first cycle, it is judged that the variablei=3 is 0 or more, and control is returned to step 2203 in the secondcycle.

Next, in step 2203 in the second cycle, as illustrated in FIG. 21, 2least significant bits are retrieved from d as w[3]=(10)₂.

Next, in step 2204 in the second cycle, it is judged that the mostsignificant bit of w[3] is 1.

As a result, in step 2207 in the second cycle, the complement of 2 iscalculated for w[3]=(10)₂, thereby obtaining v=(10)₂.

Then, in step 2208 in the second cycle, x=(s∥v)=(101110)₂ is calculated.

In step 2209 in the second cycle, the value −x obtained by adding aminus sign to x illustrated in FIG. 21 is subtracted from the value ofthe current secret key d. That is, anew secret key d is calculated asd=d−(−x)=d+x=(101101111110)₂+(101110)₂=(101110101100)₂.

Next, in step 2210 in the second cycle, the secret key d is 2 bitsright-shifted. That is, d=d>>2=(1011101011)₂ is calculated.

Next, in step 2211 in the second cycle, 1 is subtracted from the valueof the variable i. That is, i=i−1=2.

Next, in step 2212 in the second cycle, it is judged that the variablei=2 is 0 or more, and control is returned to step 2203 in the thirdcycle.

Next, in step 2203 in the third cycle, as illustrated in FIG. 21, 2least significant bits are retrieved from d as w[2]=(11)₂.

Next, in step 2204 in the third cycle, it is judged that the mostsignificant bit of w[2] is 1.

As a result, in step 2207 in the third cycle, the complement of 2 iscalculated for w[2]=(11)₂, thereby obtaining v=(01)₂.

Then, in step 2208 in the third cycle, x=(s∥v)=(101101)₂ is calculated.

In step 2209 in the third cycle, the value −x obtained by adding a minussign to x illustrated in FIG. 21 is subtracted from the value of thecurrent secret key d. That is, anew secret key d is calculated asd=d−(−x)=d+x=(1011101011)₂+(101101)₂=(1100011000)₂.

Next, in step 2210 in the third cycle, the secret key d is 2 bitsright-shifted. That is, d=d>>2=(11000110)₂ is calculated.

Next, in step 2211 in the third cycle, 1 is subtracted from the value ofthe variable i. That is, i=i−1=1.

Next, in step 2212 in the third cycle, it is judged that the variablei=1 is 0 or more, and control is returned to step 2203 in the fourthcycle.

Next, in step 2203 in the fourth cycle, as illustrated in FIG. 21, 2least significant bits are retrieved from d as w[1]=(10)₂.

Next, in step 2204 in the fourth cycle, it is judged that the mostsignificant bit of w[1] is 1.

As a result, in step 2207 in the fourth cycle, the complement of 2 iscalculated for w[1]=(10)₂, thereby obtaining v=(10)₂.

Then, in step 2208 in the fourth cycle, x=(s∥v)=(101110)₂ is calculated.

In step 2209 in the fourth cycle, the value −x obtained by adding aminus sign to x illustrated in FIG. 21 is subtracted from the value ofthe current secret key d. That is, anew secret key d is calculated asd=d−(−x)=d+x=(11000110)₂+(101110)₂=(11110100)₂.

Next, in step 2210 in the fourth cycle, the secret key d is 2 bitsright-shifted. That is, d=d>>2=(111101)₂ is calculated.

Next, in step 2211 in the fourth cycle, 1 is subtracted from the valueof the variable i. That is, i=i−1=0.

Next, in step 2212 in the fourth cycle, it is judged that the variablei=0 is 0 or more, and control is returned to step 2203 in the fifthcycle.

Next, in step 2203 in the fifth cycle, as illustrated in FIG. 21, 2least significant bits are retrieved from d as w[0]=(01)₂.

Next, in step 2204 in the fifth cycle, it is judged that the mostsignificant bit of w[0] is not 1.

As a result, in step 2205 in the fifth cycle, as illustrated in FIG. 21,x=(s∥w[0])=(101101)₂ is calculated.

Next, in step 2220 in the fifth cycle, it is judged thatd−x=(111101)₂−(101101)₂=(010000)₂ is not less than 0.

Then, in step 2206 in the fifth cycle, the value of d−x=(010000)₂ is thevalue of a new secret key d.

Next, in step 2210 in the fifth cycle, the secret key d is 2 bitsright-shifted. That is, d=d>>2=(0100)₂ is calculated.

Next, in step 2211 in the fifth cycle, 1 is subtracted from the value ofthe variable i. That is, i=i−1=−1.

Next, in step 2212 in the fifth cycle, it is judged that the variablei=−1 is not 0 or more, and control is passed to step 2213. As a result,the finally obtained secret key d=(0100)₂ is a correction value d′ asillustrated in FIG. 21.

As a result of the process above, the finally obtained window sequencesw[0] through w[4], the random number s, the correction value d′, and thevalue of the variable L=0 indicating the window starting position(indicating the start from w[0]) are output, and the process of thewindow value determination algorithm terminates.

In the above-mentioned process of the window value determinationalgorithm, k less significant bits of the window sequence w(i) areretrieved from the secret key d. If the most significant bit of thewindow sequence is 1, the complement of 2 is calculated for the windowsequence w[i] and the window value is corrected based on the sameprinciple as the case described above efficiency FIG. 13, therebyhalving the table size in the window method. Simultaneously, accordingto the present embodiment, the random number s is concatenated on themore significant bit side of the window sequence. Then, the shift of thesecret key d by the coupling of the correction of the window value andthe random number s is corrected in step 2206 or 2206′ and step 2210,and the k subsequent bit are segmented in the window sequence withrespect to the corrected secret key d. Thus, according to the presentembodiment, the shift of the secret key d by the correction of thewindow value for halving the table size and the coupling of the randomnumber s for randomization to the more significant bits side ispropagated to the more significant bit side of the secret key d. As aresult, the bit string of the secret key d remaining after thesegmentation of the necessary number of window sequences w[m−1] throughw[0] may be output as the correction value d′.

Using the determined window sequences w[0] through w[m−1], correctionvalue d′, and random numbers, the randomization and the signed windowmethod may be simultaneously attained.

Depending on the selection condition of the parameters u, k, b, and m,the value of d−x may be less than 0 before all windows are processed. Inthis case, sequentially in steps 2220, 2221, and 2213, the windowsequence up to the point immediately before the value of d−x is 0 orless and the value of the secret key d at the point are output as thecorrection value d′. The suffix of the finally truncated window sequenceis output as the variable L=i+1. That is, the output window sequencenormally maintains L=0 by the process in step 2202. Therefore, w[0]through w[m−1] hold true. However, when the condition of d−x<0 holdstrue, L=0 does not hold true. Therefore, w[0]≠w[L] through w[m−1] isoutput. That is, the variable L indicates the window starting positionin the encrypting process.

FIGS. 22A and 22B are a flowchart of the scalar multiplication algorithmof a point according to the first embodiment, and illustrates theprocess of the scalar multiplication unit 1900 of a point in FIG. 19.Described below is the process according to the flowchart.

The window sequences w[L] through w[m−1] calculated by the window valuedetermination algorithm in FIGS. 20A and 20B, the random numbers, thecorrection value d′, and the window stating point L are input.Furthermore, a point A on the elliptical curve for a scalarmultiplication is input.

First in steps 2301 through 2307, the process of the table generationphase for the signed random window method is performed. The controllingprocess corresponds to the function of the randomized table generationunit 1901 in FIG. 19.

In this example, the random number s is set in more significant bits,and a scalar multiplication operation is performed on the bit string inwhich the values of k less significant bits change from 0 to 2^(k-1).Then, the scalar multiplication result is stored in the entry of thetable which includes k less significant bits as index values.

First, the scalar multiplication sA for the point A having the randomnumbers as a scalar value is calculated, and the result is stored in thevariable U (step 2301). The normal binary method may be applied to thecalculation.

Next, to obtain a scalar multiplication result in the state in which therandom number s is arranged on the more significant bit side, thearithmetic process which performs doubling=2U on the value of thevariable U calculated in step 2301 and obtains a new variable U isperformed k times (step 2302). Otherwise, the doubling process usingU=2^(k)U may be performed by well-known high speed technology. Thus, anarithmetic component of the scalar multiplication on the random number sis obtained in the state in which the random number s is concatenated tothe window sequence of k less significant bits.

The arithmetic component of the scalar multiplication performed bychanging the less significant bit window sequence is added to the thusobtained arithmetic component, thereby generating table data.

That is, first, the value of the variable U is stored as is in the tableentry T[0] when the value by k less significant bits is 0 (step 2303)because, when the value by the k less significant bits is 0, thearithmetic component of the scalar multiplication using the value isalso 0.

Next the initial value of the variable i is set to 1 (step 2304).

Then, the addition of the point of U=U+A is performed, and the result isstored in the table entry T[i] (step 2305).

Next, 1 is added to the value of variable i (step 2306).

Then, it is judged whether or not the value of the variable i is 2^(k-1)or less (step 2307).

If the value of the variable i is 2^(k-1) or less, control is returnedto step S2305, and the calculation of the subsequent table entry isperformed.

The repetitive process from step 2305 to step 2307 is an arithmeticoperation of the scalar multiplication based on the increment by A tothe result of the scalar multiplication on the point A when the value ofk less significant bits is incremented by 1. Thus, the table data fromT[0] to T[2^(k-1)] is generated. Consider that the size of the tabledata may be about half of 2^(k), that is, 2^(k-1)+1.

When the value of the variable i reaches 2^(k-1), the table generationphase is terminated, and control is passed to the process of the scalarmultiplication phase on the point to be treated actually in the nextencrypting process. It refers to steps 2308 through 2316. Thecontrolling process corresponds to the function of the signed andrandomized window method calculation unit 1902 in FIG. 19.

First, the scalar multiplication component for the correction value d′is calculated where V=d′A (step 2308). An arithmetic operation in anormal binary method may be applied to the calculation because the valueof the correction value d′ may be disclosed, but it is still difficultto disclose the secret key d. The variable V is an output variable withwhich the output value of the encrypting process may be finallyobtained.

Next, the value of the variable j is initialized to the first suffix Lof the window sequence (step 2309).

Next, in the loop processing in steps 2310 through 2316, the repetitiveprocess of performing the scalar multiplication with reference to thetable generated in the table generation phase is performed from the moresignificant bits to the less significant bits of the secret key d.

First, the process of performing doubling 2V on the value of the outputvariable V is performed k times (step 2310). Otherwise, the 2^(k)doubling process with V=2^(k)V may be performed by well-known high speedtechnology. In the process, the digital positions of the correctionvalue d′ and the first more significant bit side window sequence w[L]are aligned.

Next, it is judged whether or not the most significant bit (MSB) of thewindow sequence w(j) is 1 (step 2311).

If the most significant bit of the window sequence w(i) is 0, the tabledata T[w(j)] having the window sequence w(j) as an index is acquired,and the data is added to the output variable V (step 2312).

On the other hand, if the most significant bit of the window sequencew(i) is 1, then the bit string index of the complement of the base forthe window sequence w(j) in binary system is calculated (step 2313). Tobe more concrete, when an exclusive OR (XOR) is calculated for eachcorresponding bit between the window sequence w(j) and the bit string2^(k)−1, each bit of the window sequence w(j) is inverted, 1 is added tothe inversion result, and the addition result is the value of thevariable index.

Next, the table data T[index] using the value of the variable index asan index is acquired, and is added to the output variable V (step 2314).

After the process in step 2312 or 2314, 1 is added to the value of thevariable j (step 2315).

Then, it is judged whether or not the value of the variable j is m−1 orless (step 2316)

If the value of the variable j is m−1 or less, control is returned tothe process in step 2310 to perform the scalar multiplication on theless significant bit side of the window sequence.

If the value of the variable j exceeds m−1, the process equivalent tothe scalar multiplication of the point A with respect to the entiresecret key d is terminated, the value of the output variable V is outputas a result of the encrypting process, and the process of the scalarmultiplication algorithm on a point illustrated in FIGS. 22A and 22B isterminated (NO as the judgment in step 2311).

Described below is an example of a concrete numerical operation of theprocess using the scalar multiplication algorithm of a point accordingto the first embodiment described above.

The window sequences w[0] through w[4], the random number s, thecorrection value d′, and the variable L indicating the window startingposition which are all input here are obtained in the numericaloperation example in FIG. 21.

First, an example of a numerical operation of the table generation phaseis described.

First in step 2301, U=(1011)₂×A is calculated using the random numbers=(1011)₂ (FIG. 21).

Next, in step 2302, the doubling process of U is performed k=2 times.That is, U=2²U=2²×(1011)₂×A=4×11×A=44A holds true.

Next, in step 2303, the table entry T[0] corresponding to the indexvalue 0 stores U=44A.

Next, in step 2304, the initialization is performed as variable i=1.

Next, in step 2305 in the first cycle, U=U+A=45A is stored in the tableentry T[1] corresponding to the index value 1.

Next, in step 2306 in the first cycle, the variable i=i+1=2 holds true.

Next, in step 2307 in the first cycle, the judgment of the variablei=2≦2¹=2 is YES, and control is returned to step 2305 in the secondcycle.

Next, in step 2305 in the second cycle, U=U+A=46A is stored in the tableentry T[2] corresponding to the index value 1.

Next, in step 2306 in the second cycle, the variable i=i+1=3 holds true.

Next, in step 2307 in the second cycle, the judgment of the variablei=3≦2¹=2 is NO, thereby terminating the table generation phase.

Thus, 2^(k-1)+1=3 pieces of table data of T[0], T[1], T[2] aregenerated.

Described next is an example of a numerical operation of the scalarmultiplication phase of a point.

First, in step 2308, since the correction value d′=(0100)₂ (FIG. 21),V=d′A=(0100)₂×A=4A is calculated.

Next, in step 2309, the variable j=L=0 holds true.

Next, in step 2310 in the first cycle, the doubling process of V isperformed k=2 times. That is, V=2^(k)V=2²V=4×4A=16A holds true.

Next, in step 2311 in the first cycle, it is judged that the MSB is not1 for the first window sequence w[0]=(01)₂ on the more significant bitside (FIG. 21).

As a result, in step 2312 in the first cycle,V=V+T[w[0]]=V+T[1]=16A+45A=61A holds true.

Next, in step 2315 in the first cycle, the variable j=j+1=1 holds true.

Next, in step 2316 in the first cycle, the judgment of the variablej=1≦m−1=5−1=4 is YES.

As a result, control is returned to step 2310 in the second cycle.

Next, in step 2310 in the second cycle, the doubling process of V isperformed k=2 times. That is, V=2^(k)V=2²V=4×61A=244A holds true.

Next, in step 2311 in the second cycle, it is judged that the MSB is 1for the second window sequence w[1]=(10)₂ on the more significant bitside (FIG. 21).

As a result, in step 2313 in the second cycle, the complement of 2 iscalculated for w[1]=(10)₂, and Index=(10)₂=2 is calculated.

Next, V=V−T[Index]=V−T[2]=244A−46A=198A holds true.

Next, in step 2315 in the second cycle, the variable j=j+1=2 holds true.

Next, in step 2316 in the second cycle, the judgment of the variablej=2≦m−1=5−1=4 is YES.

As a result, control is returned to step 2310 in the third cycle.

Next, in step 2310 in the third cycle, the doubling process of V isperformed k=2 times. That is, V=2^(k)V=2²V=4×198A=792A holds true.

Next, in step 2311 in the third cycle, it is judged that the MSB is 1for the third window sequence w[2]=(11)₂ on the more significant bitside (FIG. 21).

As a result, in step 2313 in the third cycle, the complement of 2 iscalculated for w[2]=(11)₂, and Index=(01)₂=1 is calculated.

Next, V=V−T[Index]=V−T[1]=792A−45A=747A holds true.

Next, in step 2315 in the third cycle, the variable j=j+1=3 holds true.

Next, in step 2316 in the third cycle, the judgment of the variablej=3≦m−1=5−1=4 is YES.

As a result, control is returned to step 2310 in the fourth cycle.

Next, in step 2310 in the fourth cycle, the doubling process of V isperformed k=2 times. That is, V=2^(k)V=2²V=4×747A=2988A holds true.

Next, in step 2311 in the fourth cycle, it is judged that the MSB is 1for the fourth window sequence w[3]=(10)₂ on the more significant bitside (FIG. 21).

As a result, in step 2313 in the fourth cycle, the complement of 2 iscalculated for w[3]=(10)₂, and Index=(10)₂=2 is calculated.

Next, V=V−T[Index]=V−T[2]=2988A−46A=2942A holds true.

Next, in step 2315 in the fourth cycle, the variable j=j+1=4 holds true.

Next, in step 2316 in the fourth cycle, the judgment of the variablej=4≦m−1=5−1=4 is YES.

As a result, control is returned to step 2310 in the fifth cycle.

Next, in step 2310 in the fifth cycle, the doubling process of V isperformed k=2 times. That is, V=2^(k)V=2²V=4×2942A=11768A holds true.

Next, in step 2311 in the fifth cycle, it is judged that the MSB is 1for the fifth window sequence w[4]=(11)₂ on the more significant bitside (FIG. 21).

As a result, in step 2313 in the fifth cycle, the complement of 2 iscalculated for w[4]=(11)₂, and Index=(01)₂=1 is calculated.

Next, V=V−T[Index]=V−T[1]=11768A−45A=11723A holds true.

Next, in step 2315 in the fifth cycle, the variable j=j+1=5 holds true.

Next, in step 2316 in the fifth cycle, the judgment of the variablej=5≦m−1=5−1=4 is NO.

As a result, the value of the output variable V is output as a finalresult of the encrypting operation process. It corresponds to the result((10110111001011)₂×A=11723A) of the scalar multiplication in a normalmethod. Then, the present embodiment is secured against the SPA by thewindow method, also secured against the DPA by randomized table data,capable of realizing the reduction (2^(k-1)+1 pieces) of table size, andalso capable of realizing an encrypting operation process for simplecarry control.

Described next is the second embodiment of a concrete process performedby the window value determination unit 1800 illustrated in FIG. 18 andthe scalar multiplication unit 1900 for a point illustrated in FIG. 19.

In the second embodiment, in addition to the process according to thefirst embodiment, a different random number s (i) is used for each valueof a window sequence. As a result, further confusion may be attained.

FIGS. 23A and 23B are a flowchart of the window value determinationalgorithm according to the second embodiment, and illustrates theprocess of the window value determination unit 1800 in FIG. 18.Described below is the process according to the flowchart.

In FIGS. 23A and 23B, the step in which the same process as theflowchart in FIGS. 20A and 20B according to the first embodiment isassigned the same reference numeral.

The process in FIGS. 23A and 23B is different from the process in FIGS.20A and 20B first in the process in the random number generation phase.In the process, after the value of the variable j is initialized to 0(step 2401), the value of the variable j is incremented up to 2^(k-1)(steps 2403 and 2404), and b-bit random number s (j) is generated foreach variable j (step 2402).

Then, in step 2405 in FIGS. 23A and 23B corresponding to step 2205 inFIGS. 20A and 20B, a binary bit string x=(s(w(i))∥w(i)) obtained byconcatenating the random number s (w(i)) corresponding to the value ofthe window sequence w(i) is acquired on the more significant bit side ofthe window sequence w(i).

Furthermore, in step 2406 in FIGS. 23A and 23B corresponding to step2208 in FIGS. 20A and 20B, the bit string x=(s(v)∥v) is obtained bycoupling the random number s(v) corresponding to the value of the bitstring v on the more significant bit side of the bit string v (step2406).

Thus described window values w[0] through w[m−1] are output with therandom numbers s[0] through s[2^(k-1)], the correction value d′, and thevariable L indicating the window starting position.

An example of a concrete numeral calculation of the process of thewindow value determination algorithm in the second embodiment isdescribed below with reference to the explanatory view of FIG. 24.

The values u, k, b, and m are determined as with the first embodiment.

For example, assume the elliptical curve cryptography where k=2, b=4,d=(11010010101111)₂ (length of d: u=14 bits). In this case, thefollowing equations hold true by the calculation example by math 4.h=u−b=10m=5b=u−k×m=14−2×5=4(no change)

Under the conditions, first in step 2401, the variable j=0 is set asinitial value.

Next, in step 2402 in the first cycle, for example, (0111)₂ is generatedas a 4-bit random number s(0).

Next, in step 2403 in the first cycle, variable j=j+1=1.

Then, in step 2404 in the first cycle, the judgment of the variablej=1≦2²⁻¹=2 is YES, and control is returned to step 2402 in the secondcycle.

Next, in step 2402 in the second cycle, for example, (1001)₂ isgenerated as a 4-bit random number s(1).

Next, in step 2403 in the second cycle, the variable j=j+1=2 holds true.

Then, in step 2404 in the second cycle, the judgment of the variablej=2≦2²⁻¹=2 is YES, and control is returned to step 2402 in the thirdcycle.

Next, in step 2402 in the third cycle, for example, (1100)₂ is generatedas a 4-bit random number s(2).

Next, in step 2403 in the third cycle, the variable j=j+1=3.

Then, in step 2404 in the third cycle, the judgment of the variablej=3≦2²⁻¹=2 is NO, thereby terminating the process in the random numbergeneration phase.

Next, in step 2202, the initialization is performed for i=m−1=5−1=4,L=0.

Next, in step 2203 in the first cycle, the 2 least significant bits ofdare retrieved and assigned w[4]=(11)₂ as illustrated in FIG. 24.

Next, in step 2204 in the first cycle, it is judged that the mostsignificant bit bit of w[4] is 1.

As a result, in step 2207 in the first cycle, the complement of 2 iscalculated for w[4]=(11)₂, thereby obtaining v=(01)₂.

Then, in step 2406 in the first cycle, x=(s((01)₂)∥v)=(100101)₂ iscalculated using the random number s(v)=s((01)₂) corresponding tov=(01)₂.

Then, in step 2209 in the first cycle, the value −x obtained by adding aminus sign to x in FIG. 24 is subtracted from the value of the currentsecret key d. That is, a new secret key d is calculated asd=d−(−x)=d+x=(11010010101111)₂+(100101)₂=(11010011010100)₂.

Next, in step 2210 in the first cycle, the secret key d above is 2 bitsright-shifted. That is, d=d>>2=(110100110101)₂ is calculated.

Next, in step 2211 in the first cycle, 1 is subtracted from the value ofthe variable i. That is, i=i−1=3.

Next, in step 2212 in the first cycle, it is judged that the variablei=3 is 0 or more, and control is returned to step 2203 in the secondcycle.

Next, in step 2203 in the second cycle, as illustrated in FIG. 24, 2least significant bits are retrieved from d as w[3]=(01)₂.

Next, in step 2204 in the second cycle, it is judged that the mostsignificant bit of w[3] is not 1.

As a result, in step 2405 in the second cycle, as illustrated in FIG.24, x=(s((01)₂)∥w[3])=(100101)₂ is calculated using the random numbers(w[3])=s((01)₂) corresponding to w[3]=(01)₂.

Next, in step 2220 in the second cycle, it is judged thatd−x=(110100110101)₂−(100101)₂=(110100010000)₂ is not 0 or less.

Then, in step 2206 in the second cycle, the value d−x=(110100010000)₂above is the value of a new secret key d.

Next, in step 2210 in the second cycle, the secret key d above is 2 bitsright-shifted. That is, d=d>>2=(1101000100)₂ is calculated.

Next, in step 2211 in the second cycle, 1 is subtracted from the valueof the variable i. That is, i=i−1=2.

Next, in step 2212 in the second cycle, it is judged that the variablei=2 is 0 or more, and control is returned to step 2203 in the thirdcycle.

Next, in step 2203 in the third cycle, as illustrated in FIG. 24, 2least significant bits are retrieved from d as w[2]=(00)₂.

Next, in step 2204 in the third cycle, it is judged that the mostsignificant bit of w[2] is not 1.

As a result, in step 2405 in the third cycle, as illustrated in FIG. 24,x=(s((00)₂)∥w[2])=(011100)₂ is calculated using the random numbers(w[2])=s((00)₂) corresponding to w[2]=(00)₂.

Next, in step 2220 in the third cycle, it is judged thatd−x=(1101000100)₂−(011100)₂=(1100101000)₂ is not 0 or less.

Then, in step 2206 in the third cycle, the value d−x=(1100101000)₂ aboveis the value of a new secret key d.

Next, in step 2210 in the third cycle, the secret key d above is 2 bitsright-shifted. That is, d=d>>2=(11001010)₂ is calculated.

Next, in step 2211 in the third cycle, 1 is subtracted from the value ofthe variable i. That is, i=i−1=1.

Next, in step 2212 in the third cycle, it is judged that the variablei=1 is 0 or more, and control is returned to step 2203 in the fourthcycle.

Next, in step 2203 in the fourth cycle, as illustrated in FIG. 24, 2least significant bits are retrieved from d as w[1]=(10)₂.

Next, in step 2204 in the fourth cycle, it is judged that the mostsignificant bit of w[1] is 1.

As a result, in step 2207 in the fourth cycle, the complement of 2 iscalculated for w[1]=(10)₂, thereby obtaining v=(10)₂.

Then, in step 2406 in the fourth cycle, x=(s((10)₂)∥V)=(110010)₂ iscalculated using the random number s((10)₂) corresponding to v=(10)₂.

Then, in step 2209 in the fourth cycle, the value −x obtained by addinga minus sign to x in FIG. 24 is subtracted from the value of the currentsecret key d. That is, a new secret key d is calculated asd=d−(−x)=d+x=(11001010)₂+(110010)₂=(11111100)₂.

Next, in step 2210 in the fourth cycle, the secret key d above is 2 bitsright-shifted. That is, d=d>>2=(111111)₂ is calculated.

Next, in step 2211 in the fourth cycle, 1 is subtracted from the valueof the variable i. That is, i=i−1=0.

Next, in step 2212 in the fourth cycle, it is judged that the variablei=0 is 0 or more, and control is returned to step 2203 in the fifthcycle.

Next, in step 2203 in the fifth cycle, as illustrated in FIG. 24, 2least significant bits are retrieved from d as w[0]=(11)₂.

Next, in step 2204 in the fifth cycle, it is judged that the mostsignificant bit of w[0] is 1.

As a result, in step 2207 in the fifth cycle, the complement of 2 iscalculated for w[0]=(11)₂, thereby obtaining v=(01)₂.

Then, in step 2406 in the fifth cycle, x=(s((01)₂)∥=(100101)₂ iscalculated using the random number s((01)₂) corresponding to v=(01)₂.

Then, in step 2209 in the fifth cycle, the value −x obtained by adding aminus sign to x in FIG. 24 is subtracted from the value of the currentsecret key d. That is, a new secret key d is calculated asd=d−(−x)=d+x=(111111)₂+(100101)₂=(1100100)₂.

Next, in step 2210 in the fifth cycle, the secret key d above is 2 bitsright-shifted. That is, d=d>>2=(11001)₂ is calculated.

Next, in step 2211 in the fifth cycle, 1 is subtracted from the value ofthe variable i. That is, i=i−1=−1.

Next, in step 2212 in the fifth cycle, it is judged that the variablei=−1 is not 0 or more, and control is passed to step 2213. As a result,the finally obtained secret key d=(11001)₂ is correction value d′ asillustrated in FIG. 24.

As a result of the processes above, the finally obtained values ofwindow sequences w[0] through w[4], the random numbers s[0] throughs[2^(k-1)], the correction value d′, and the variable L=0 indicating thewindow starting position, thereby terminating the process of the windowvalue determination algorithm.

FIGS. 25A and 25B are a flowchart of the scalar multiplication algorithmaccording to the second embodiment, and illustrates the process of thescalar multiplication unit 1900 of a point in FIG. 19. Described belowis the process according to the flowchart.

In FIGS. 25A and 25B, the step in which the same process as theflowchart in FIGS. 22A and 22B according to the first embodiment isassigned the same reference numeral.

The process in FIGS. 25A and 25B is different from the process in FIGS.22A and 22B in the process of the table generation phase in steps 2501through 2510. The process of the scalar multiplication phase of a pointin steps 2308 through 2316 is the same as that in FIGS. 22A and 22B.

The window sequences w[L] through w[m−1] calculated by the window valuedetermination algorithm in FIGS. 23A and 23B, the random numbers s[0]through s[2^(k-1)], the correction value d′, and the variable Lindicating the window stating position are input. Furthermore, a point Aon the elliptical curve for a scalar multiplication is input.

First, the value of the variable i is initialized to 0 (step 2501). Thevariable i determines a table entry.

Next, the scalar multiplication s[i]A for the point A having the randomnumber s[i] corresponding to the current variable i as a scalar value iscalculated, and the result is stored in the variable U (step 2502). Thenormal binary method may be applied to the calculation.

Next, to obtain a scalar multiplication result in the state in which therandom number s[i] is arranged on the more significant bit side, thearithmetic process which performs doubling=2U on the value of thevariable U calculated in step 2502 and obtains a new variable U isperformed k times (step 2503). Otherwise, the doubling process usingU=2^(k)U may be performed by well-known high speed technology. Thus, anarithmetic component of the scalar multiplication on the random numbers[i] is obtained in the state in which the random number s[i] isconcatenated to the window sequence of k less significant bits.

Next, the value of the variable j is initialized to 0 (step 2504).

Then, the adding process of the point of U=U+A is repeated (step 2506)so far as the value of the variable j is smaller than the value of thevariable i (step 2505) while incrementing the value of the variable j(step 2507).

When the value of the variable j reaches the value of the variable i,the addition result of the variable U is stored in the table entry T[i](step 2508).

Next, 1 is added to the value of variable i (step 2509).

Then, it is judged whether or not the value of the variable i is 2^(k-1)or less (step 2510).

If the value of the variable i is 2^(k-1) or less, control is returnedto step S2502, and the calculation of the subsequent table entry isperformed.

As described above, table data T[i] may be generated using the randomnumber s[i] different for each table entry. Thus, the confusion of tabledata is further attained, thereby intensifying the fastness against theDPA.

Hereafter, the encrypting operation process is performed using thecontents of the table data T[i] in the scalar multiplication phase of apoint in steps 2308 through 2316.

Described below is a concrete example of a numerical operation in theprocess of the scalar multiplication algorithm of a point according tothe second embodiment.

The input values of the window sequences w[0] through w[4], the randomnumbers s[0] through s[2], the correction value d′, and the variable Lindicating the window starting position are obtained in theabove-mentioned example of the numerical operation in FIG. 24. Describedfirst is an example of a numerical operation of the table generationphase.

First, in step 2501, the variable i=0 holds true. Next, in step 2502 inthe first cycle of the variable i, U=(0111)₂×A is calculated using therandom numbers [0]=(0111)₂ (FIG. 24).

Next, in step 2503 in the first cycle of the variable i, the doublingprocess of U is performed k=2 times. That is,U=2²U=2²×(0111)₂×A=4×7×A=28A holds true.

Next, in step 2504 in the first cycle of the variable i, the variablej=0 holds true.

Next, in step 2505 in the first cycle of the variable j in the firstcycle of the variable i, the judgment of j=0<i=0 is NO.

As a result, in step 2508 in the first cycle of the variable i, U=28A isstored in the table entry T[0] corresponding to the index value 0.

Next, in step 2509 in the first cycle, the variable i=i+1=1 holds true.

Next in step 2510 in the first cycle, the judgment of the variablei=1≦2¹=2 is YES, and control is returned to step 2502 in the secondcycle.

Next, in step 2502 in the second cycle of the variable i, U=(1001)₂×A iscalculated using the random number s [1]=(1001)₂ (FIG. 24).

Next, in step 2503 in the second cycle of the variable i, the doublingprocess of U is performed k=2 times. That is,U=2²U=2²×(1001)₂×A=4×9×A=36A holds true.

Next, in step 2504 in the second cycle of the variable i, the variablej=0 holds true.

Next, in step 2505 in the first cycle of the variable j in the secondcycle of the variable i, the judgment of j=0<i=1 is YES.

As a result, in step 2506 in the first cycle of the variable j in thesecond cycle of the variable i, U=U+A=36A+A=37A is calculated.

Next, in step 2507 in the first cycle of the variable j in the secondcycle of the variable i, the variable j=j+1=1 holds true, therebyreturning control to step 2505 in the second cycle of the variable j.

Next, in step 2505 in the second cycle of the variable j in the secondcycle of the variable i, the judgment of j=1<i=1 is NO.

As a result, in step 2508 in the second cycle of the variable i, U=37Ais stored in the table entry T[1] corresponding to the index value 1.

Next, in step 2509 in the second cycle, the variable i=i+1=2 holds true.

Next in step 2510 in the second cycle, the judgment of the variablei=2≦2¹=2 is YES, and control is returned to step 2502 in the thirdcycle.

Next, in step 2502 in the third cycle of the variable i, U=(1100)₂×A iscalculated using the random number s [2]=(1100)₂ (FIG. 24).

Next, in step 2503 in the third cycle of the variable i, the doublingprocess of U is performed k=2 times. That is,U=2²U=2²×(1100)₂×A=4×12×A=48A holds true.

Next, in step 2504 in the third cycle of the variable i, the variablej=0 holds true.

Next, in step 2505 in the first cycle of the variable j in the thirdcycle of the variable i, the judgment of j=0<i=2 is YES.

As a result, in step 2506 in the first cycle of the variable j in thethird cycle of the variable i, U=U+A=48A+A=49A is calculated.

Next, in step 2507 in the first cycle of the variable j in the thirdcycle of the variable i, the variable j=j+1=1 holds true, therebyreturning control to step 2505 in the second cycle of the variable j.

Next, in step 2505 in the second cycle of the variable j in the thirdcycle of the variable i, the judgment of j=1<i=2 is YES.

As a result, in step 2506 in the second cycle of the variable j in thethird cycle of the variable i, U=U+A=49A+A=50A is calculated.

Next, in step 2507 in the second cycle of the variable j in the thirdcycle of the variable i, the variable j=j+1=2 holds true, therebyreturning control to step 2505 in the third cycle of the variable j.

Next, in step 2505 in the third cycle of the variable j in the thirdcycle of the variable i, the judgment of j=2<i=2 is NO.

As a result, in step 2508 in the third cycle of the variable i, U=50A isstored in the table entry T[2] corresponding to the index value 2.

Next, in step 2509 in the third cycle, the variable i=i+1=3 holds true.

Next in step 2510 in the third cycle, the judgment of the variablei=3≦2¹=2 is NO, thereby terminating the process of the random numbergeneration phase.

Thus, 2^(k-1)+1=3 table data, that is, T[0], T[1], and T[2] aregenerated.

Described next is an example of a numerical operation in the scalarmultiplication phase of a point.

First, in step 2308, the correction value d′=(11001)₂ holds true (FIG.24), V=d′A=(11001)₂×A=25A is calculated.

Next, in step 2309, the variable j=L=0 holds true.

Next, in step 2310 in the first cycle, the doubling process of V isperformed k=2 times. That is, V=2^(k)V=2²V=4×25=100A holds true.

Next, in step 2311 in the first cycle, it is judged that the MSB is 1for the first window sequence w[0]=(11)₂ on the more significant bitside (FIG. 24).

As a result, in step 2313 in the first cycle, the complement of 2 iscalculated for w[0]=(11)₂, and Index=(01)₂=1 is calculated.

Next, V=V−T[Index]=V−T[1]=100A−37A=63A is calculated.

Next, in step 2315 in the first cycle, the variable j=j+1=1 holds true.

Next, in step 2316 in the first cycle, the judgment of the variablej=1≦m−1=5−1=4 is YES.

As a result, control is returned to step 2310 in the second cycle.

Next, in step 2310 in the second cycle, the doubling process of V isperformed k=2 times. That is, V=2^(k)V=2²V=4×63A=252A holds true.

Next, in step 2311 in the second cycle, it is judged that the MSB is 1for the second window sequence w[1]=(10)₂ on the more significant bitside (FIG. 24).

As a result, in step 2313 in the second cycle, the complement of 2 iscalculated for w[1]=(10)₂, and Index=(10)₂=2 is calculated.

Next, V=V−T[Index]=V−T[2]=252A−50A=202A holds true.

Next, in step 2315 in the second cycle, the variable j=j+1=2 holds true.

Next, in step 2316 in the second cycle, the judgment of the variablej=2≦m−1=5−1=4 is YES.

As a result, control is returned to step 2310 in the third cycle.

Next, in step 2310 in the third cycle, the doubling process of V isperformed k=2 times. That is, V=2^(k)V=2²V=4×202A=808A holds true.

Next, in step 2311 in the third cycle, it is judged that the MSB is not1 for the third window sequence w[2]=(00)₂ on the more significant bitside (FIG. 24).

As a result, in step 2312 in the third cycle,V=V+T[w[2]]=V+T[0]=808A+28A=868A holds true.

Next, in step 2315 in the third cycle, the variable j=j+1=3 holds true.

Next, in step 2316 in the third cycle, the judgment of the variablej=3≦m−1=5−1=4 is YES.

As a result, control is returned to step 2310 in the fourth cycle.

Next, in step 2310 in the fourth cycle, the doubling process of V isperformed k=2 times. That is, V=2^(k)V=2²V=4×868A=3344A holds true.

Next, in step 2311 in the fourth cycle, it is judged that the MSB is not1 for the fourth window sequence w[3]=(01)₂ on the more significant bitside (FIG. 24).

As a result, in step 2312 in the fourth cycle,V=V+T[w[3]]=V+T[1]=3344A+37A=3381A holds true.

Next, in step 2315 in the fourth cycle, the variable j=j+1=4 holds true.

Next, in step 2316 in the fourth cycle, the judgment of the variablej=4≦m−1=5−1=4 is YES.

As a result, control is returned to step 2310 in the fifth cycle.

Next, in step 2310 in the fifth cycle, the doubling process of V isperformed k=2 times. That is, V=2^(k)V=2²V=4×3381A=13524A holds true.

Next, in step 2311 in the fifth cycle, it is judged that the MSB is 1for the fifth window sequence w[4]=(11)₂ on the more significant bitside (FIG. 24).

As a result, in step 2313 in the fifth cycle, the complement of 2 iscalculated for w[4]=(11)₂, and Index=(01)₂=1 is calculated.

Next, V=V−T[Index]=V−T[1]=13524A−37A=13487A holds true.

Next, in step 2315 in the fifth cycle, the variable j=j+1=5 holds true.

Next, in step 2316 in the fifth cycle, the judgment of the variablej=5≦m−1=5−1=4 is NO.

As a result, the value of the output variable V is output as a finalresult of the encrypting operation process. It corresponds to the result((11010010101111)₂×A=13487A) of the scalar multiplication in a normalmethod. Then, in the present embodiment, the table data is randomized bythe random number s[i] for each entry in addition to the effectaccording to the first embodiment, thereby attaining further securityagainst the DPA.

Described below is the third embodiment. In the third embodiment, thetechnology of improving the confusion by using a different random numbers(i) for each value of a window sequence as with the second embodimentis applied to the modular exponentiation operation (RSA) encryptingprocess other than the elliptical curve cryptography.

The third embodiment may be embodied with the same configuration as thewindow value determination unit 1800 in FIG. 18 and the configuration inwhich the scalar multiplication unit 1900 of a point in FIG. 19 isreplaced with an modular exponentiation calculation unit.

FIGS. 26A and 26B are a flowchart of the window value determinationalgorithm according to the third embodiment. Described below is theprocess according to the flowchart. First, the process in a randomnumber generation phase is performed in steps 3401 through 3404. In thisprocess, after the value of the variable j is initialized to 0 (step3401), the value of the variable j is incremented by 2^(k)−1 (steps 3403and 3401), thereby generating a b-bit random number s(j) (step 3402).

In the process of the random number generation phase, a b-bit randomnumber s(j) is generated for each value from 0 to 2^(k)−1 which may bechanged as a window value. Next, the process of the window valuedetermination phase in steps 3405 through 3415 is described.

First, the value of the variable i is initialized to m−1, and the valueof the variable L is initialized to 0 (step 3405).

Next, k least significant bits of the current secret key d are retrievedand defined as a window sequence w(i) (step 3406).

Next, a binary bit string x=(s(w(i))∥w(i)) is obtained by concatenatingthe random number s(w(i)) corresponding to the value of the windowsequence w(i) on the more significant bit side of the window sequencew(i) (step 3408).

Then, a bit string x is subtracted from the current secret key d, and itis described whether or not the subtraction result is less than 0 (step3420).

Unless the subtraction result is less than 0, the subtraction result isthe bit string of anew secret key d (step 3420→3409).

Next, if a new secret key d is calculated in step 3409, the bit stringof the secret key d is right-shifted by k bits, and the k leastsignificant bits are truncated (step 3410).

Next, 1 is subtracted from the value of the variable i (step 3414).

Then, it is judged whether or not the value of the variable i is 0 ormore (step 3415).

If the value of the variable i is 0 or more, control is returned to step3406, and a series of processes from step 3406 to step 3415 areperformed again (step 3415→3406).

If the value of the variable i is less than 0 as a result of therepeated operations above, control is passed to step 3416 (step3415→3416).

In addition, also when the value of d−x is less than 0 in step 3420above, control is passed to step 3416 after the value of the current i+1is set to the value of the variable L (step 3420→3421). The process isdescribed later.

Finally, the value of the current secret key d is defined as thecorrection value d′ (step 3416).

Then, the finally obtained window sequences w[0] through w[m−1], randomnumbers s[0] through s[2^(k)−1], correction value d′, and variable Lindicating the window starting position are output, thereby terminatingthe process of the window value determination algorithm.

A concrete numerical operation example of the process of the windowvalue determination algorithm according to the third embodiment isdescribed below with reference to the explanatory view in FIG. 27.

In this example, assume the process of the modular exponentiationoperation cryptography (RSA cryptography etc.) when k=2, b=4,d=(100011000101101)₂ (length of d: u=15 bits) holds true. In this case,the following equations hold true by the calculation example by math 4.h=u−b=11m=5b=u−k×m=15−2×5=5(changed)

Under the conditions, first in step 3401, the variable j=0 is set asinitial value.

Next, in step 3402 in the first cycle, for example, (01011)₂ isgenerated as a 5-bit random number s(0).

Next, in step 3403 in the first cycle, variable j=j+1=1.

Then, in step 3404 in the first cycle, the judgment of the variablej=1≦2²−1=3 is YES, and control is returned to step 3402 in the secondcycle.

Next, in step 3402 in the second cycle, for example, (11000)₂ isgenerated as a 5-bit random number s(1).

Next, in step 3403 in the second cycle, the variable j=j+1=2.

Then, in step 3404 in the second cycle, the judgment of the variablej=2≦2²−1=3 is YES, and control is returned to step 2402 in the thirdcycle.

Next, in step 3402 in the third cycle, for example, (11011)₂ isgenerated as a 5-bit random number s(2).

Next, in step 3403 in the third cycle, variable j=j+1=3.

Then, in step 3404 in the third cycle, the judgment of the variablej=3≦2²−1=3 is YES, and control is returned to step 3402 in the fourthcycle.

Next, in step 3402 in the fourth cycle, for example, (00101)₂ isgenerated as a 5-bit random number s(3).

Next, in step 3403 in the fourth cycle, the variable j=j+1=4 holds true.

Then, in step 3404 in the fourth cycle, the judgment of the variablej=4≦2²−1=3 is NO, thereby terminating the process in the random numbergeneration phase.

Next, in step 3405, the initialization of i=m−1=5−1=4, L=0 is performed.

Next, in step 3406 in the first cycle, as illustrated in FIG. 27, 2least significant bits of d are retrieved for w[4]=(01)₂.

Next, in step 3408 in the first cycle, as illustrated in FIG. 27, x=(s(01)₂)∥w[4]) (1100001)₂ is calculated using the random numbers(w[4])=s((01)₂) corresponding to w[4]=(01)₂.

Next, in step 3420 in the first cycle, it is judged thatd−x=(100011000101101)₂−(1100001)₂=(100010111001100)₂ is not less than 0.

Then, in step 3420 in the first cycle, the value d−x=(100010111001100)₂above is the value of a new secret key d.

Next, in step 3413 in the first cycle, the secret key d is right shiftedby 2 bits. That is, d=d>>2=(1000101110011)₂ is calculated.

Next, in step 3414 in the first cycle, 1 is subtracted from the value ofvariable i. That is, i=i−1=3 holds true.

Next, in step 3415 in the first cycle, it is judged that the variablei=3 is 0 or more, thereby returning control to step 3406 in the secondcycle.

Next, in step 3406 in the second cycle, as illustrated in FIG. 27, twoleast significant bits of d are retrieved as w[3]=(11)₂.

Next, in step 3408 in the second cycle, as illustrated in FIG. 27,x=(s((11)₂)∥w[3])=(00101111)₂ is calculated using the random numbers(w[3])=s((11)₂) corresponding to w[3]=(11)₂.

Next, in step 3420 in the second cycle, it is judged that)d−x=(1000101110011)₂−(0010111)₂=(1000101011100)₂ is not less than 0.

Then, in step 3420 in the second cycle, the value d−x (1000101011100)₂above is the value of a new secret key d.

Next, in step 3413 in the second cycle, the secret key d is rightshifted by 2 bits. That is, d=d>>2=(10001010111)₂ is calculated.

Next, in step 3414 in the second cycle, 1 is subtracted from the valueof variable i. That is, i=i−1=2 holds true.

Next, in step 3415 in the second cycle, it is judged that the variablei=2 is 0 or more, thereby returning control to step 3406 in the thirdcycle.

Next, in step 3406 in the third cycle, as illustrated in FIG. 27, twoleast significant bits of d are retrieved as w[2]=(11)₂.

Next, in step 3408 in the third cycle, as illustrated in FIG. 27,x=(s((11)₂)∥w[2])=(0010111)₂ is calculated using the random numbers(w[2])=s((11)₂) corresponding to w[2]=(11)₂.

Next, in step 3420 in the third cycle, it is judged thatd−x=(10001010111)₂−(0010111)₂=(10001000000)₂ is not less than 0.

Then, in step 3420 in the third cycle, the value d−x=(10001000000)₂above is the value of a new secret key d.

Next, in step 3413 in the third cycle, the secret key d is right shiftedby 2 bits. That is, d=d>>2=(100010000)₂ is calculated.

Next, in step 3414 in the third cycle, 1 is subtracted from the value ofvariable i. That is, i=i−1=1 holds true.

Next, in step 3415 in the third cycle, it is judged that the variablei=1 is 0 or more, thereby returning control to step 3406 in the fourthcycle.

Next, in step 3406 in the fourth cycle, as illustrated in FIG. 27, twoleast significant bits of d are retrieved as w[1]=(00)₂.

Next, in step 3408 in the fourth cycle, as illustrated in FIG. 27,x=(s((00)₂)∥w[1])=(0101100)₂ is calculated using the random numbers(w[1])=s((00)₂) corresponding to w[1]=(00)₂.

Next, in step 3420 in the fourth cycle, it is judged thatd−x=(100010000)₂−(0101100)₂=(11100100)₂ is not less than 0.

Then, in step 3420 in the fourth cycle, the value d−x=(11100100)₂ aboveis the value of a new secret key d.

Next, in step 3413 in the fourth cycle, the secret key d is rightshifted by 2 bits. That is, d=d>>2=(111001)₂ is calculated.

Next, in step 3414 in the second cycle, 1 is subtracted from the valueof variable i. That is, i=i−1=0 holds true.

Next, in step 3415 in the fourth cycle, it is judged that the variablei=0 is 0 or more, thereby returning control to step 3406 in the fifthcycle.

Next, in step 3406 in the fifth cycle, as illustrated in FIG. 27, twoleast significant bits of d are retrieved as w[0]=(01)₂.

Next, in step 3408 in the fifth cycle, as illustrated in FIG. 27,x=(s((01)₂)∥w[0])=(1100001)₂ is calculated using the random numbers(w[0])=s((01)₂) corresponding to w[0]=(01)₂.

Next, in step 3420 in the fifth cycle, it is judged thatd−x=(111001)₂−(1100001)₂ is less than 0.

As a result, in step 3421 in the fifth cycle, L=i+1=0+1=1 holds true.Thus, the window sequence w[0] is not adopted.

Then, control is passed to step 3416, and the value of the currentsecret key d is defined as the correction value d′=(111001)₂.

When the judgment of d−x<0 in step 3420 is not YES, and it is judged instep 3415 that the value of the variable i is less than 0, that is, whenthe window sequence is determined by the set number, control is passedto step 3416, and the correction value d′ is calculated.

As described above, the window sequences w[1] through w[4], the randomnumbers s[0] through s[3], the correction value d′, and the variable Lindicating the window starting position are output, thereby terminatingthe process.

FIGS. 28A and 28B are a flowchart of the modular exponentiationalgorithm according to the third embodiment. Described below is theprocess according to the flowchart.

The window sequences w[L] through w[m−1] calculated by the window valuedetermination algorithm in FIGS. 23A and 23B, the random numbers s[0]through s[2^(k-1)], the correction value d′, and the variable Lindicating the window stating position are input. Furthermore, an inputvalue A and a modulo number n for modular exponentiation operation areinput.

First, the value of the variable i is initialized to 0 (step 3501). Thevariable i determines a table entry.

Next, the modular exponentiation operation A^(s[i]) mod n for the pointA having the random number s[i] corresponding to the current variable ias an exponential value is calculated, and the result is stored in thevariable U (step 3502). The normal binary method may be applied to thecalculation.

Next, to obtain an modular exponentiation operation result in the statein which the random number s[i] is arranged on the more significant bitside, the arithmetic process which performs U=U² k times on the value ofthe variable U calculated in step 3502 and obtains a new variable U isperformed (step 3503). Thus, an arithmetic component of the modularexponentiation operation on the random number s[i] is obtained in thestate in which the random number s[i] is concatenated to the windowsequence of k less significant bits.

Next, the value of the variable j is initialized to 0 (step 3504).

Then, the arithmetic process of U=U×A mod n is repeated (step 3506) sofar as the value of the variable j is smaller than the value of thevariable i (step 3505) while incrementing the value of the variable j(step 3507).

When the value of the variable j reaches the value of the variable i,the addition result of the variable U is stored in the table entry T[i](step 3508).

Next, 1 is added to the value of variable i (step 3509).

Then, it is judged whether or not the value of the variable i is 2^(k-1)or less (step 3510).

If the value of the variable i is 2^(k-1) or less, control is returnedto step 3502, and the calculation of the subsequent table entry isperformed.

As described above, table data T[i] may be generated using the randomnumber s[i] different for each table entry. Thus, the randomness oftable data is further attained, thereby intensifying the fastnessagainst the DPA.

When the value of the variable i reaches 2^(k-1), the table generationphase is terminated, and control is passed to the process of the modularexponentiation phase to be treated actually in the next encryptingprocess. It refers to steps 3511 through 3519.

First, the modular exponentiation component for the correction value d′is calculated where V=A^(d)″ mod n (step 3511). An arithmetic operationin a normal binary method may be applied to the calculation because thevalue of the correction value d′ may be disclosed, but it is stilldifficult to disclose the secret key d. The variable V is an outputvariable with which the output value of the encrypting process may befinally obtained.

Next, the value of the variable j is initialized to the first suffix Lof the window sequence (step 3512).

Next, in the loop processing in steps 3514 through 3519, the repetitiveprocess of performing the modular exponentiation operation withreference to the table generated in the table generation phase isperformed from the more significant bits to the less significant bits ofthe secret key d.

First, the process V=V² mod n of performing square modularexponentiation operation on the value of the output variable V andobtaining a new value of V is performed k times (step 3514). In theprocess, the digital positions of the correction value d′ and the firstmore significant bit side window sequence w[L] are aligned.

Next, the table data T[w(j)] using the window sequence w(j) as an indexis acquired. Using the data, the operation of V−V×T[w(j)] mod n isperformed (step 3515).

Then, 1 is added to the value of the variable j (step 3518).

Then, it is judged whether or not the value of the variable j is m−1 orless (step 3519)

If the value of the variable j is m−1 or less, control is returned tothe process in step 3514 to perform the modular exponentiation operationon the less significant bit side of the window sequence.

If the value of the variable j exceeds m−1, the process equivalent tothe exponential residue operation of the input value A with respect tothe entire secret key d is terminated, the value of the output variableV is output as a result of the encrypting process, and the process ofthe exponential residue algorithm illustrated in FIGS. 28A and 28B isterminated (NO as the judgment in step 3519).

Described below is an example of a concrete numerical operation of theprocess using the modular exponentiation operation algorithm accordingto the third embodiment described above.

The window sequences w[1] through w[4], the random number s[0] throughs[3], the correction value d′, and the variable L indicating the windowstarting position which are all input here are obtained in the numericaloperation example in FIG. 27.

First, an example of a numerical operation of the table generation phaseis described.

First, in step 3501, the variable i=0 holds true.

Next in step 3502 in the first cycle of the variable i, U=A⁽⁰¹⁰¹¹⁾ mod nis calculated using the random number s[0]=(01011)₂ (FIG. 27).

Next, in step 3503 in the first cycle of the variable i, the operationof U=U⁴ mod n=A^((01011)×4) mod n=A⁴⁴ mod n is performed.

Next, in step 3504 in the first cycle of the variable i, the variablej=0 holds true.

Next, in step 3505 in the first cycle of the variable j in the firstcycle of the variable i, the judgment of j=0<i=0 is NO.

As a result, in step 3508 in the first cycle of the variable i, U=A⁴⁴mod n is stored in the table entry T[0] corresponding to the index value0.

Next, in step 3509 in the first cycle, the variable i=i+1=1 holds true.

Next, in step 3510 in the first cycle, the judgment of the variablei=1≦2²−1=3 is YES, and control is returned to step 3502 in the secondcycle.

Next, in step 3502 in the second cycle of the variable i, U=A⁽¹¹⁰⁰⁰⁾ modn is calculated using the random number s [1]=(11000)₂ (FIG. 27).

Next, in step 3503 in the second cycle of the variable i, the operationof U=U⁴ mod n=A^((11000)×4) mod n=A⁹⁶ mod n is performed.

Next, in step 3504 in the second cycle of the variable i, the variablej=0 holds true.

Next, in step 3505 in the first cycle of the variable j in the secondcycle of the variable i, the judgment of j=0<i=1 is YES.

As a result, in step 3506 in the first cycle of the variable j in thesecond cycle of the variable i, U=U×A mod n=A⁹⁷ mod n is calculated.

Next, in step 3507 in the first cycle of the variable j in the secondcycle of the variable i, the variable j=j+1=1 holds true, and control isreturned to step 3505 in the second cycle of the variable j.

Next, in step 3505 in the second cycle of the variable j in the secondcycle of the variable i, the judgment of j=1<i=1 is NO.

As a result, in step 3508 in the second cycle of the variable i, U=A⁹⁷mod n is stored in the table entry T[1] corresponding to the index value1.

Next, in step 3509 in the second cycle, the variable i=i+1=2 holds true.

Next, in step 3510 in the second cycle, the judgment of the variablei=2≦2²−1=3 is YES, and control is returned to step 3502 in the thirdcycle.

Next, in step 3502 in the third cycle of the variable i, U=A⁽¹¹⁰¹¹⁾ modn is calculated using the random number s [2]=(11011)₂ (FIG. 27).

Next, in step 3503 in the third cycle of the variable i, the operationof U=U⁴ mod n=A^((11011)×4) mod n=A¹⁰⁸ mod n is performed.

Next, in step 3504 in the third cycle of the variable i, the variablej=0 holds true.

Next, in step 3505 in the first cycle of the variable j in the secondcycle of the variable i, the judgment of j=0<i=2 is YES.

As a result, in step 3506 in the first cycle of the variable j in thethird cycle of the variable i, U=U×A mod n=A¹⁰⁹ mod n is calculated.

Next, in step 3507 in the first cycle of the variable j in the thirdcycle of the variable i, the variable j=j+1=1 holds true, and control isreturned to step 3505 in the second cycle of the variable j.

Next, in step 3505 in the second cycle of the variable j in the thirdcycle of the variable i, the judgment of j=1<i=2 is YES.

As a result, in step 3506 in the second cycle of the variable j in thethird cycle of the variable i, U=U×A mod n=A¹¹⁰ mod n is calculated.

Next, in step 3507 in the second cycle of the variable j in the thirdcycle of the variable i, the variable j=j+1=2 holds true, and control isreturned to step 3505 in the third cycle of the variable j.

Next, in step 3505 in the third cycle of the variable j in the thirdcycle of the variable i, the judgment of j=2<i=2 is NO.

As a result, in step 3508 in the third cycle of the variable i, U=A¹¹⁰mod n is stored in the table entry T[2] corresponding to the index value2.

Next, in step 3509 in the third cycle, the variable i=i+1=3 holds true.

Next, in step 3510 in the third cycle, the judgment of the variablei=3≦2²−1=3 is YES, and control is returned to step 3502 in the fourthcycle.

Next, in step 3502 in the fourth cycle of the variable i, U=A⁽⁰⁰¹⁰¹⁾ modn is calculated using the random number s [3]=(00101)₂ (FIG. 27).

Next, in step 3503 in the fourth cycle of the variable i, the operationof U=U⁴ mod n=A^((00101)×4) mod n=A²⁰ mod n is performed.

Next, in step 3504 in the fourth cycle of the variable i, the variablej=0 holds true.

Next, in step 3505 in the first cycle of the variable j in the fourthcycle of the variable i, the judgment of j=0<i=3 is YES.

As a result, in step 3506 in the first cycle of the variable j in thefourth cycle of the variable i, U=U×A mod n=A²¹ mod n is calculated.

Next, in step 3507 in the first cycle of the variable j in the fourthcycle of the variable i, the variable j=j+1=1 holds true, and control isreturned to step 3505 in the second cycle of the variable j.

Next, in step 3505 in the second cycle of the variable j in the fourthcycle of the variable i, the judgment of j=1<i=3 is YES.

As a result, in step 3506 in the second cycle of the variable j in thefourth cycle of the variable i, U=U×A mod n=A²² mod n is calculated.

Next, in step 3507 in the second cycle of the variable j in the fourthcycle of the variable i, the variable j=j+1=2 holds true, and control isreturned to step 3505 in the third cycle of the variable j.

Next, in step 3505 in the third cycle of the variable j in the fourthcycle of the variable i, the judgment of j=2<i=3 is YES.

As a result, in step 3506 in the third cycle of the variable j in thefourth cycle of the variable i, U=U×A mod n=A²³ mod n is calculated.

Next, in step 3507 in the third cycle of the variable j in the fourthcycle of the variable i, the variable j=j+1=3 holds true, and control isreturned to step 3505 in the fourth cycle of the variable j.

Next, in step 3505 in the fourth cycle of the variable j in the fourthcycle of the variable i, the judgment of j=3<i=3 is NO.

As a result, in step 3508 in the fourth cycle of the variable i, U=A²³mod n is stored in the table entry T[3] corresponding to the index value3.

Next, in step 3509 in the fourth cycle, the variable i=i+1=4 holds true.

Next, in step 3510 in the fourth cycle, the judgment of the variablei=4≦2²−1=3 is NO, thereby terminating the process of the random numbergeneration phase.

As described above, 2^(k)=4 pieces of table data for T[0], T[1], T[2],and T[3] are generated.

Described next is an example of a numerical calculation of the modularexponentiation operation phase.

First in step 3511, since the correction value d′=(111001)₂ holds true(FIG. 27), V=A^(d′) mod n=A⁽¹¹¹⁰⁰¹⁾ mod n=A⁵⁷ mod n is calculated.

Next, in step 3512, the variable j=L=1 holds true (as illustrated inFIG. 27, the starting position of the window sequence is w[1]).

Next, in step 3514 in the first cycle, V=V² mod n is calculated ktimes=(A⁵⁷)²)² mod n=A²²⁸ mod n.

Next, in step 3515 in the first cycle, V=V×T[w[1]]=A²²⁸×A⁴⁴ mod n=A²⁷²mod n is calculated.

Next, in step 3518 in the first cycle, the variable j=j+1=2 holds true.

Next, in step 3519 in the first cycle, the judgment of the variablej=2≦m−1=5−1=4 is YES.

As a result, control is returned to step 3514 in the second cycle.

Next, in step 3514 in the second cycle, V=V² mod n is calculated ktimes=(A²⁷²)²)² mod n=A¹⁰⁸⁸ mod n.

Next, in step 3515 in the second cycle, V=V×T[w[2]]=A¹⁰⁸⁸×A²³ modn=A¹¹¹¹ mod n is calculated.

Next, in step 3518 in the second cycle, the variable j=j+1=3 holds true.

Next, in step 3519 in the second cycle, the judgment of the variablej=3≦m−1=5−1=4 is YES.

As a result, control is returned to step 3514 in the third cycle.

Next, in step 3514 in the third cycle, V=V² mod n is calculated ktimes=(A¹¹¹¹)²)² mod n=A⁴⁴⁴⁴ mod n.

Next, in step 3515 in the third cycle, V=V×T[w[3]]=A⁴⁴⁴⁴×A²³ mod n=A⁴⁴⁵⁷mod n is calculated.

Next, in step 3518 in the third cycle, the variable j=j+1=4 holds true.

Next, in step 3519 in the third cycle, the judgment of the variablej=4≦m−1=5−1=4 is YES.

As a result, control is returned to step 3514 in the fourth cycle.

Next, in step 3514 in the fourth cycle, V=V² mod n is calculated ktimes=(A⁴⁴⁶⁷)²)² mod n=A¹⁷⁸⁶⁸ mod n.

Next, in step 3515 in the fourth cycle, V=V×T[w[4]]=A¹⁷⁸⁶⁸×A²³ modn=A¹⁷⁹⁶⁵ mod n is calculated.

Next, in step 3518 in the fourth cycle, the variable j=j+1=5 holds true.

Next, in step 3519 in the fourth cycle, the judgment of the variablej=5≦m−1=5−1=4 is NO.

As a result, the value of the output variable V is output as a finalresult of the encrypting process. It corresponds to the result(A¹¹⁰¹⁰⁰¹⁰¹⁰¹¹¹¹ mod n=A¹⁷⁹⁶⁵ mod n) of the modular exponentiationoperation in a normal method, and realizes a process secured against theDPA and SPA.

The effect of the present embodiment may be summarized as an addition tothe chart in FIG. 15 as illustrated in FIG. 29. FIG. 29 illustrates theencrypting process provided with simple carry control by the table sizeof about half (2^(k-1)+1) of a normal method with security against theDPA (and SPA) according to the first and second embodiments.

Although not illustrated in FIG. 29, the second and third embodimentsrealize an encrypting process which provides table data with highrandomness and high security against the DPA.

Furthermore, the third embodiment may provide a further securedencrypting process against the DPA in a modular exponentiationoperation.

All examples and conditional language recited herein are intended forpedagogical purposes to aid the reader in understanding the inventionand the concepts contributed by the inventor to furthering the art, andare to be construed as being without limitation to such specificallyrecited examples and conditions, nor does the organization of suchexamples in the specification relate to a showing of the superiority andinferiority of the invention. Although the embodiment (s) of the presentinvention has (have) been described in detail, it should be understoodthat the various changes, substitutions, and alterations could be madehereto without departing from the spirit and scope of the invention.

The invention claimed is:
 1. An encrypting device which performs anencrypting operation on a point A on an elliptical curve by a secret keyd using b, m, k, i, and j as natural numbers excluding 0, and a randomnumber s, each window sequence w(i), and a correction value d′corresponding to the secret key d, the secret key d being a binarysecret key in elliptical curve cryptography, a bit length of the secretkey d being (b+m×k) bits, the encrypting device comprising: a windowsequence storage device that stores each window sequence w(i); acorrection value storage that stores the correction value d′; a randomnumber storage that stores the random number s; a memory that storesinstructions; and a processor device that executes the instructionsstored in the memory to perform a process including: obtaining an indexvalue by concatenating the random number s, stored in the random numberstorage, on a more significant bit side of a bit string of k bits whilesequentially changing a value of the bit string of k bits, where kindicates a number of bits of each window sequence w(i) stored in thewindow sequence storage device, performing scalar multiplication on thepoint A using the index value as a scalar value, generating a randomizedtable by storing a calculation result of the scalar multiplication astable data corresponding to the index value, setting as an initial valueof an output variable V a calculation result obtained by performing thescalar multiplication on the point A using the correction value d′stored in the correction value storage as the scalar value, performing afirst process and a second process on each obtained window sequence w(j)from a more significant bit side to a less significant bit side, eachobtained window sequence w(j) being obtained by selecting each windowsequence w(i) from the window sequence storage device, the first processincluding executing doubling on the elliptical curve, the doubling beingexecuted k times, where k indicates a number of bits of each windowsequence w(i) stored in the window sequence storage device, and thesecond process including acquiring table data in the randomized tableusing the obtained window sequence w(j) as an index and adding theacquired table data to the output variable V when a most significant bitof the obtained window sequence w(j) is 0, and acquiring the table datain the randomized table using as an index a bit string of a complementof a base for the obtained window sequence w(j) in binary system andadding to the output variable V a value obtained by adding a minus signto the acquired table data when a most significant bit of the obtainedwindow sequence w(j) is 1; and outputting a value of the output variableV as a result of the encrypting operation.
 2. The encrypting deviceaccording to claim 1, wherein the random number storage stores therandom number s for each value of each window sequence w(i), and in theobtaining of the index value, the index value is obtained byconcatenating with the bit string of k bits the random number scorresponding to the value of the bit string of k bits.
 3. An encryptingmethod used by a computer which performs an encrypting operation on apoint A on an elliptical curve by a secret key d using b, m, k, i, and jas natural numbers excluding 0, and a random number s, each windowsequence w(i), and a correction value d′ corresponding to the secret keyd, the secret key d being a binary secret key in elliptical curvecryptography, a bit length of the secret key d being (b+m×k) bits, theencrypting method comprising: obtaining, by a hardware processor from amemory device, an index value by concatenating the random number s on amore significant bit side of a bit string of k bits while sequentiallychanging a value of the bit string of k bits; wherein k indicates anumber of bits of each window sequence w(i) stored in a window sequencestorage device; performing scalar multiplication on the point A usingthe index value as a scalar value; generating a randomized table bystoring a calculation result of the scalar multiplication as table datacorresponding to the index value; setting as an initial value of anoutput variable V a calculation result obtained by performing the scalarmultiplication on the point A using the correction value d′ as thescalar value; performing a first process and a second process on eachobtained window sequence w(j) from a more significant bit side to a lesssignificant bit side, each obtained window sequence w(j) being obtainedby selecting each window w(i) from the window sequence storage device,the first process including executing doubling on the elliptical curve,the doubling being executed k times, where k indicates a number of bitsof each window sequence w(i), and the second process including acquiringtable data in the randomized table using the obtained window sequencew(j) as an index and adding to the acquired table data to the outputvariable V when a most significant bit of the obtained window sequencew(j) is 0, and acquiring the table data in the randomized table using asan index a bit string of a complement of a base for the obtained windowsequence w(j) in binary system and adding to the output variable V avalue obtained by adding a minus sign to the acquired table data when amost significant bit of the obtained window sequence w(j) is 1; andoutputting a value of the output variable V as a result of theencrypting operation.
 4. A non-transitory computer-readable recordingmedium storing a program for executing a process by a computer toperform elliptical curve cryptography by performing an encryptingoperation on a point A on an elliptical curve by a secret key d using b,m, k, i, and j as natural numbers excluding 0, and a random number s,each window sequence w(i), and a correction value d′ corresponding tothe secret key d, the secret key d being a binary secret key inelliptical curve cryptography, a bit length of the secret key d being(b+m×k) bits, the process comprising: obtaining, by a computer from amemory device, an index value by concatenating the random number s on amore significant bit side of a bit string of k bits while sequentiallychanging a value of the bit string of k bits where k indicates to anumber of bits of each window sequence w(i) stored in a window sequencestorage device; performing scalar multiplication on the point A usingthe index value as a scalar value; generating a randomized table bystoring a calculation result of the scalar multiplication as table datacorresponding to the index value; setting as an initial value of anoutput variable V a calculation result obtained by performing the scalarmultiplication on the point A using the correction value d′ as thescalar value; performing a first process and a second process on eachobtained window sequence w(j) from a more significant bit side to a lesssignificant bit side, each obtained window sequence w(j) being obtainedby selecting each window sequence w(i) from the window sequence storagedevice, the first process including executing doubling on the ellipticalcurve, the doubling being executed k times, where k indicates a numberof bits of each window sequence w(i), and the second process includingacquiring table data in the randomized table using the obtained windowsequence w(j) as an index and adding the acquired table data to theoutput variable V when a most significant bit of the obtained windowsequence w(j) is 0, and acquiring the table data in the randomized tableusing as an index a bit string of a complement of a base for theobtained window sequence w(j) in binary system and adding to the outputvariable V as value obtained by adding a minus sign to the acquiredtable data when a most significant bit of the obtained window sequencew(j) is 1; outputting a value of the output variable V as a result ofthe encrypting operation.